Trojan:MSIL/Remcos!pz removal

The Trojan:MSIL/Remcos!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:MSIL/Remcos!pz virus can do?

• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the PyInstaller malware family
• Binary file triggered multiple YARA rules
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:MSIL/Remcos!pz?

File Info:
name: 7FF15042B2A1C03B3CAD.mlw
path: /opt/CAPEv2/storage/binaries/21ef5d7e12182ba6c175a11213a3fa6c562336fe135fc0d92845e075d0ebbcd2
crc32: 54B081DA
md5: 7ff15042b2a1c03b3cad80d5afa1a7f6
sha1: 5f628685eb449ce97ba5989f7d5e1c48eeccd9a7
sha256: 21ef5d7e12182ba6c175a11213a3fa6c562336fe135fc0d92845e075d0ebbcd2
sha512: c181b3b32d33903cdff57045e81797c5e4a615a66c8b5dea2336f3117703255cdbf5fcc6fd3fe19003bf9c36a4db08db93051163d16223b0af49bb0231841114
ssdeep: 196608:u1GBB5N1/wbITLwOjUqVL2Vmd6+DTcLZy7YM30Lzaj0IGOpCcpdJjqZotwUrb:TN1obI/fL2Vmd6mC0GzajPHdJ2ZCw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E6C6123462A00B79E15BC73993E0C1E7867DA8CEEF11A3CE0A9447773B122935D51EAD
sha3_384: 476f2a450a868c5a7a80b5f22beca8f448f6446a9156d6ed76c218ba6c3cf794c500878a8f5aadc4c86f8373f20ec115
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-08-28 18:31:40

Version Info:
Translation: 0x0000 0x04b0
CompanyName: EMAIL SENDER BY MEGASP
FileDescription: EMAIL SENDER BY MEGASP
FileVersion: 5.0.62.6
InternalName: EMAIL SENDER BY MEGASP.exe
LegalCopyright: ©EMAIL SENDER BY MEGASP
OriginalFilename: EMAIL SENDER BY MEGASP.exe
ProductName: EMAIL SENDER BY MEGASP
ProductVersion: 5.0.62.6
Assembly Version: 5.0.62.6

Trojan:MSIL/Remcos!pz also known as:

How to remove Trojan:MSIL/Remcos!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.