Should I remove “Trojan.MsilFC.S20983721”?

The Trojan.MsilFC.S20983721 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.MsilFC.S20983721 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Uses Windows utilities for basic functionality
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Creates known Njrat/Bladabindi RAT registry keys
• Collects information to fingerprint the system

How to determine Trojan.MsilFC.S20983721?

File Info:
name: ED608753295396336EC9.mlw
path: /opt/CAPEv2/storage/binaries/add81555c6a23c7e493a3fc67f7632f6c751adfe19da76870552eb6c386b3bea
crc32: 1D1A129E
md5: ed608753295396336ec9c7b66b23349b
sha1: 586367a07b3a3c0758aab389356b996c98ba52df
sha256: add81555c6a23c7e493a3fc67f7632f6c751adfe19da76870552eb6c386b3bea
sha512: db8db392e860a0965cf0c7b75b9dbdaea32f5712791e1d1284faa18b9008a2e1899ff4512f68ec8c3d1d8bb70ba24637c053869bfa505a4e391dfda64c035ced
ssdeep: 384:xLK5LoBnKGYWh1YKfIkVzPddL1MNAQk93vmhm7UMKmIEecKdbXTzm9bVhcas66ye:x7Am9fQNA/vMHTi9bDs
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10ED2E72837618232D1EF067A4562DA7042B5DC4BF112EB0E4CD96CDB7B3B38A0A45EE5
sha3_384: 05df8a69f8ed59c2b26ea6539e8edbbc51f2370f87f619f6feaaed67a48c13b760739a4adcd2ca8762e728ceea4e416c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-28 19:40:07

Version Info:
0: [No Data]

Trojan.MsilFC.S20983721 also known as:

How to remove Trojan.MsilFC.S20983721?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.