Trojan.MSIL.Marsilia.I

The detection of Trojan.MSIL.Marsilia.I on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its characteristics, and guidance on how to remove it from your system.

What Is Trojan.MSIL.Marsilia.I?

Trojan.MSIL.Marsilia.I is a type of malware that can compromise the security and integrity of your system. The name itself suggests it is a Trojan-type threat, which typically disguises itself as legitimate software to gain unauthorized access to a system. Trojans can be used to steal sensitive information, install additional malware, or provide unauthorized access to hackers.

How Trojan.MSIL.Marsilia.I Operates

Like other Trojans, Trojan.MSIL.Marsilia.I is designed to operate stealthily, making it difficult for users to detect its presence. It may exploit vulnerabilities in software or use social engineering tactics to trick users into installing it. Once installed, it can communicate with its command and control servers to receive instructions, which may include stealing data, installing additional malware, or spreading to other systems.

Trojans often rely on user interaction to activate their malicious payload, which can be triggered by opening a malicious email attachment, clicking on a link, or installing a compromised software package. They can also spread through infected software downloads, infected websites, or infected USB drives.

Symptoms of Infection

Systems infected with Trojan.MSIL.Marsilia.I may exhibit a range of symptoms, including slow system performance, frequent crashes, and unusual network activity. You may also notice unfamiliar programs or icons on your system, or receive unexpected pop-ups and alerts. In some cases, the Trojan may not display any noticeable symptoms, making it difficult to detect without the use of anti-malware tools.

• Unexplained changes to system settings or configuration
• Appearance of unfamiliar or suspicious programs
• Increased network activity or unusual traffic patterns
• Frequent system crashes or errors
• Slow system performance or responsiveness

How to Remove Trojan.MSIL.Marsilia.I

1. Boot your system in Safe Mode with Networking to prevent the Trojan from loading and to allow for easier removal.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs associated with Trojan.MSIL.Marsilia.I.
3. Uninstall any suspicious or unfamiliar programs that may be related to the Trojan.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your system and perform another full scan with your anti-malware tool to ensure that all remnants of the Trojan have been removed.

Conclusion

Removing Trojan.MSIL.Marsilia.I from your system requires careful attention to detail and a thorough understanding of the threat. By following the steps outlined in this report, you can help to ensure the security and integrity of your system. It is also essential to practice safe computing habits, such as avoiding suspicious emails and attachments, using strong passwords, and keeping your software up to date, to prevent similar threats in the future.

Remember, the key to preventing malware infections is vigilance and proactive security measures. Stay informed about the latest threats and take the necessary steps to protect your system and your sensitive information.

Analysis Report

General information

Family Name:	Trojan.MSIL.Marsilia.I
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: d3d736edee00f609d97438a8e463765d SHA1: 539d8ad0e4358c02360e2bcd0600e531b5b48bdc SHA256: 3A0556288323FEB86440B0B51DFCB15454A9F1AFF7A42A035479FEB054D41C09 File Size: 9.12 MB, 9120328 bytes

MD5: e41208ab749e2c97cbc2184ee32de67b SHA1: 2d888ab44afeea85b1835e8d1b61b9123a3798cf SHA256: 855AEBFAF8B56FE216A3155EE0AE547DC24E6D8728D73CDE71223AFDFE216A49 File Size: 6.32 MB, 6318544 bytes

MD5: 93424278d68cc243fd35120b83aa6103 SHA1: 4f50d2dc1c6b18ca98ca6e0ced8f6808686febde SHA256: 6FC13989F7A4398B5F52D3DBC9C08956D0A1BE569748704229E3C11F712252CD File Size: 7.60 MB, 7597800 bytes

MD5: 590d8c094b2c46e51566fb7a301a2cef SHA1: 25b47d22259ae15ae53bb557c01491d110504157 SHA256: BC1449979742533918737C0634B12B62AD4E734A2F3750A49ED96E770CF8CC90 File Size: 9.12 MB, 9119696 bytes

MD5: 73269a235671856eb23890095b076a58 SHA1: 89437817f4f75fd37d6777f4f82ce0d3cbcf6698 SHA256: 95A72506304FDAAA2884E113D2E31E2BBD3DC1377A715A2E67DB679579F71E9F File Size: 6.38 MB, 6375173 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have exports table
• File doesn't have security information
• File is .NET application
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Assembly Version	1.0.0.0
File Description	DestinyWars Prestarter
File Version	1.0.0.0
Internal Name	DestinyWars.exe Prestarter.exe
Legal Copyright	Copyright © 2023 DestinyWars © 2025
Original Filename	DestinyWars.exe Prestarter.exe
Product Name	DestinyWars Prestarter
Product Version	1.0.0.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
APservers Code Sign	APservers Root CA	Self Signed
DestinyWars Code Sign	DestinyWars Root CA	Self Signed

File Traits

• .NET
• HighEntropy
• WinZip SFX
• x86
• ZIP (In Overlay)

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	70
Potentially Malicious Blocks:	41
Whitelisted Blocks:	29
Unknown Blocks:	0

Visual Map

x 0 x 0 0 0 0 0 0 0 x 0 x 0 x x x 0 0 0 0 x 0 x x 0 x x 0 0 x x 0 x x x x x x x x x x x x x x x x x x x x 0 0 0 0 x x 0 x 0 x 0 x x 0 0 0 x

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• MSIL.Agent.FGI
• MSIL.Marsilia.I

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\roaming\gravitlauncherstore\java\adoptium-lts-openjfx\java.zip	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	ck qjg �� �v �� ۀ ��T������% ��3bBx��#�� &� &�-(�(X�(� )�`*J*9 *�" -!R0P% 1`1�1HO5,]@V�A��B��G�IH[uH�pN$ N�U_* X�.\te _�zc�wc�zh�rj�bk`k�ql(�lR o�� q�XtǤvy�v�! w�ny�9{b�|ۘ	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	dk qjg �� �v �� ۀ ��T������% ��3bBx��#�� &� &�-(�(X�(� )�`*J*9 *�" -!R0P% 1`1�1HO5,]@V�A��B��G�IH[uH�pN$ N�U_* X�.\te _�zc�wc�zh�rj�bk`k�ql(�lR o�� q�XtǤvy�v�! w�ny�9{b�|ۘ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
User Data Access	GetComputerName GetComputerNameEx GetUserDefaultLocaleName GetUserObjectInformation
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
Network Info Queried	GetAdaptersAddresses GetNetworkParams
Other Suspicious	AdjustTokenPrivileges
Network Winsock2	WSASend WSASocket WSAStartup WSAttemptAutodialName
Network Winsock	bind closesocket freeaddrinfo getaddrinfo setsockopt
Network Winhttp	WinHttpOpen
Encryption Used	BCryptOpenAlgorithmProvider