Trojan

Trojan:MSIL/DCRat.SK!MTB removal guide

Malware Removal

The Trojan:MSIL/DCRat.SK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/DCRat.SK!MTB virus can do?

  • Presents an Authenticode digital signature
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • The executable used a known stolen/malicious Authenticode signature
  • Anomalous binary characteristics
  • Binary compilation timestomping detected

How to determine Trojan:MSIL/DCRat.SK!MTB?



File Info:

name: 047AF34AF65EFD5C6EE3.mlw
path: /opt/CAPEv2/storage/binaries/931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
crc32: 9748E282
md5: 047af34af65efd5c6ee38eb7ad100a01
sha1: 61809e8f559b27e72a603a45a53116327845dbeb
sha256: 931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d
sha512: 7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d
ssdeep: 24576:8hO9pgi3qe4zKA7ng3oZ8wtEFxa79othN/yJZkdej+4:X8ew7ngYZ/A079oXN/yJwej+4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F745AF03BB9C9E93D49E0735689909302FFEC505A5A2AB2ED9AC95E9FCC33511E0D14F
sha3_384: 825b632e65f20ac31f4f147db8d8bc69714c8b971f1175da762c9c56f96f2e3262638d6a3eb2151413e91ec116d135c8
ep_bytes: ff250020400000000000000000000000
timestamp: 2087-02-09 05:56:28


Version Info:

Translation: 0x0000 0x04b0

Trojan:MSIL/DCRat.SK!MTB also known as:

BkavW32.AIDetectNet.01
LionicTrojan.MSIL.Vasal.4!c
Elasticmalicious (high confidence)
CynetMalicious (score: 99)
McAfeeGenericRXIN-PY!047AF34AF65E
MalwarebytesBackdoor.DCRat
SangforSuspicious.Win32.Save.a
K7AntiVirusSpyware ( 005515e81 )
BitDefenderGen:Variant.Johnnie.185255
K7GWSpyware ( 005515e81 )
CrowdStrikewin/malicious_confidence_100% (W)
VirITTrojan.Win32.Dnldr30.BDGD
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Spy.Agent.CBX
Paloaltogeneric.ml
ClamAVWin.Packed.Uztuby-9878629-0
KasperskyHEUR:Trojan.MSIL.Vasal.gen
AlibabaTrojan:MSIL/DCRat.03b6f4e1
NANO-AntivirusTrojan.Win32.Vasal.gancjm
MicroWorld-eScanGen:Variant.Johnnie.185255
AvastWin32:TrojanX-gen [Trj]
Ad-AwareGen:Variant.Johnnie.185255
EmsisoftGen:Variant.Johnnie.185255 (B)
DrWebTrojan.DownLoader30.19763
ZillyaTrojan.Agent.Win32.1145685
TrendMicroBackdoor.MSIL.DCRAT.A
McAfee-GW-EditionGenericRXIN-PY!047AF34AF65E
FireEyeGeneric.mg.047af34af65efd5c
SophosMal/Generic-S
IkarusTrojan.MSIL.Spy
GDataGen:Variant.Johnnie.185255
WebrootW32.Trojan.Gen
AviraTR/AD.GenSteal.lfdlb
MAXmalware (ai score=94)
ArcabitTrojan.Johnnie.D2D3A7
ZoneAlarmHEUR:Trojan.MSIL.Vasal.gen
MicrosoftTrojan:MSIL/DCRat.SK!MTB
AhnLab-V3Trojan/Win32.Bladabindi.C3329020
VBA32TScope.Trojan.MSIL
ALYacTrojan.Agent.Vasal
CylanceUnsafe
TrendMicro-HouseCallBackdoor.MSIL.DCRAT.A
TencentMalware.Win32.Gencirc.11ef1d48
YandexTrojan.Vasal!nRF6r6K8UWk
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.74337780.susgen
FortinetMSIL/Vasal.CBX!tr
BitDefenderThetaGen:NN.ZemsilF.34666.krX@aCEJrhe
AVGWin32:TrojanX-gen [Trj]
Cybereasonmalicious.af65ef
PandaTrj/CI.A

How to remove Trojan:MSIL/DCRat.SK!MTB?

Trojan:MSIL/DCRat.SK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment