Trojan:MSIL/ClipBanker.E!MTB (file analysis)

The Trojan:MSIL/ClipBanker.E!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/ClipBanker.E!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Trojan:MSIL/ClipBanker.E!MTB?


File Info:
name: 597D40531E2548E58638.mlw
path: /opt/CAPEv2/storage/binaries/a6e6a5fdb81dfee9c9d99e1455f826dcf7d3330f7fa7ca961557636f5e05dc95
crc32: 2E13D70B
md5: 597d40531e2548e586383b57e5ae109f
sha1: ff629b3896b5ed77d6bb59d14c6127aa2a8b6673
sha256: a6e6a5fdb81dfee9c9d99e1455f826dcf7d3330f7fa7ca961557636f5e05dc95
sha512: 9ab1c55d1ae73b48f0ab286554f8188de4b6644e5c52a20e7cd1f3f6d55fb67e79ed1da214115f722462aba4c9a5910b3967386086b4c28be7051ce8a052d9e2
ssdeep: 192:tz3/zxoEHpdE27sdtV2s4YEM7szEaE4vEv/37EoHE0l3E1EpEEv//qnaLE3EWNUV:tz32DdtTfV7VCyoTi5H
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E652B8897BA64171E6FBCD358DFB62D15AB05A932118DE4B059811C70D23EF0EE83E61
sha3_384: 345500cc68e9e519de29aaefd38478ba6b3cf6f9dbefd22d0606653166cf35e57c1fca2d606eabb2758b3f69411a30f4
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-09-10 05:40:53

Version Info:
Translation: 0x0000 0x04b0
Comments: CryptoRipper
FileDescription:  
FileVersion: 0.1.6.0
InternalName: Crypto Ripper + reFUD pack2.exe
LegalCopyright: Copyright ©  2021
OriginalFilename: Crypto Ripper + reFUD pack2.exe
ProductVersion: 0.1.6.0
Assembly Version: 0.1.6.0

Trojan:MSIL/ClipBanker.E!MTB also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	IL:Trojan.MSILZilla.26022
Cybereason	malicious.896b5e
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.ND
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Hesv.gen
BitDefender	IL:Trojan.MSILZilla.26022
MicroWorld-eScan	IL:Trojan.MSILZilla.26022
Avast	Win32:BankerX-gen [Trj]
Emsisoft	IL:Trojan.MSILZilla.26022 (B)
DrWeb	Trojan.ClipBankerNET.7
VIPRE	IL:Trojan.MSILZilla.26022
McAfee-GW-Edition	GenericRXTR-RE!597D40531E25
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.597d40531e2548e5
Ikarus	Trojan.MSIL.ClipBanker
MAX	malware (ai score=80)
Microsoft	Trojan:MSIL/ClipBanker.E!MTB
Arcabit	IL:Trojan.MSILZilla.D65A6
ZoneAlarm	HEUR:Trojan.MSIL.Hesv.gen
GData	IL:Trojan.MSILZilla.26022
Google	Detected
AhnLab-V3	Malware/Win32.RL_Trojanspy.C4047092
McAfee	GenericRXTR-RE!597D40531E25
Malwarebytes	Clipper.Trojan.Stealer.DDS
Panda	Trj/GdSda.A
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.36662.am0@aqXhsVi
AVG	Win32:BankerX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:MSIL/ClipBanker.E!MTB?

Trojan:MSIL/ClipBanker.E!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X