Trojan

Trojan:MSIL/Clipbanker.GTT!MTB removal guide

Malware Removal

The Trojan:MSIL/Clipbanker.GTT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/Clipbanker.GTT!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/Clipbanker.GTT!MTB?



File Info:

name: 6B8E1D1A27B7F3290A27.mlw
path: /opt/CAPEv2/storage/binaries/b5b54cb61de4821cc6484255701b170ec931996b35b3901177b0651ae46e69c2
crc32: B07495CA
md5: 6b8e1d1a27b7f3290a2756c74ce534c2
sha1: 07a8c0d13c78e3535e719429abc05ee4bb44875b
sha256: b5b54cb61de4821cc6484255701b170ec931996b35b3901177b0651ae46e69c2
sha512: e11aa2651ab8c163a3f2f17522ca1cebbbe7a877a17f4f5220e2064a481abadb750ffaac9be7fd8eec31bcf6d6035af34a88e71ee3d20eb6c290b73da9d70991
ssdeep: 24576:JJGbg1aKsi+mzQy8tezTVXSwHpWDwRlnLew7:JJ+gfKmzEWpwwRNt7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17205F1373A5ECA61C218137A84DFC21803796F46AE23D74A7EC93B9E0E027965F4915F
sha3_384: 68fb039d0e1b4dba39add8d6ebfc69c863284bf6581053dd6d68c2711ce8571e73e982f11c9c3dd7a4f6bf6035b31d6c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-25 04:38:58


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft
FileDescription: CSMDown
FileVersion: 1.0.0.0
InternalName: IClientChannelSinkProvid.exe
LegalCopyright: Copyright © Microsoft 2010
LegalTrademarks: 
OriginalFilename: IClientChannelSinkProvid.exe
ProductName: CSMDown
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Clipbanker.GTT!MTB also known as:

LionicTrojan.MSIL.Agensla.i!c
tehtrisGeneric.Malware
DrWebTrojan.PackedNET.1173
MicroWorld-eScanTrojan.GenericKD.38720821
FireEyeTrojan.GenericKD.38720821
CAT-QuickHealTrojan.Agent
McAfeePWS-FDFL!6B8E1D1A27B7
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusSpyware ( 00589d031 )
AlibabaTrojanPSW:MSIL/Clipbanker.7c578d4a
K7GWTrojan ( 0058d70b1 )
Cybereasonmalicious.13c78e
BitDefenderThetaGen:NN.ZemsilF.34264.1q0@auQcjoo
VirITTrojan.Win32.PSWStealer.DFE
CyrenW32/MSIL_Troj.BWN.gen!Eldorado
Elasticmalicious (high confidence)
ESET-NOD32MSIL/Spy.AgentTesla.C
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.38720821
AvastWin32:PWSX-gen [Trj]
Ad-AwareTrojan.GenericKD.38720821
EmsisoftTrojan.Agent (A)
TrendMicroTrojanSpy.MSIL.NEGASTEAL.RJAHQDR
McAfee-GW-EditionBehavesLike.Win32.Generic.cc
Trapminemalicious.high.ml.score
SophosMal/Generic-S + Troj/MSIL-SGT
SentinelOneStatic AI – Malicious PE
GDataMSIL.Trojan-Stealer.AgentTesla.EHC662
JiangminTrojan.PSW.MSIL.dhzs
WebrootW32.Trojan.Gen
AviraTR/AgentTesla.kvrww
Antiy-AVLTrojan/Generic.ASMalwS.3515A7F
GridinsoftRansom.Win32.Sabsik.sa
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
MicrosoftTrojan:MSIL/Clipbanker.GTT!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R468069
ALYacTrojan.GenericKD.38720821
MAXmalware (ai score=100)
VBA32TScope.Trojan.MSIL
MalwarebytesTrojan.Crypt.MSIL
TrendMicro-HouseCallTrojanSpy.MSIL.NEGASTEAL.RJAHQDR
TencentMsil.Trojan-qqpass.Qqrob.Wqxi
YandexTrojan.Igent.bXmrFL.3
IkarusTrojan.Inject
eGambitGeneric.Malware
FortinetMSIL/Kryptik.34C2!tr
AVGWin32:PWSX-gen [Trj]
PandaTrj/WLT.G
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan:MSIL/Clipbanker.GTT!MTB?

Trojan:MSIL/Clipbanker.GTT!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment