Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Backdoor
Threat report

Backdoor:MSIL/DCRat.C!MTB removal guide

Published Apr 17, 2024 Backdoor category 3 min read
Report context

What to verify before removal

Backdoor:MSIL/DCRat.C!MTB removal guide deserves a credential-safety review because this backdoor label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with 7B66B0A16900E321F7A6.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
7B66B0A16900E321F7A6.mlw
  • Compare the suspicious file name with 7B66B0A16900E321F7A6.mlw.
  • Confirm the detection name matches Backdoor:MSIL/DCRat.C!MTB removal guide before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The Backdoor:MSIL/DCRat.C!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Backdoor:MSIL/DCRat.C!MTB virus can do?

  • Authenticode signature is invalid
  • CAPE detected the DCRat malware family
  • Anomalous binary characteristics

How to determine Backdoor:MSIL/DCRat.C!MTB?



File Info:

name: 7B66B0A16900E321F7A6.mlw
path: /opt/CAPEv2/storage/binaries/8ae5155254add551f0993a8c423accfecfff5800254710e31aaab1e8e154fa3e
crc32: 0A27698A
md5: 7b66b0a16900e321f7a63bab13ed986b
sha1: 91f9481ccded0c15fd6cb7e7629a278d19887a23
sha256: 8ae5155254add551f0993a8c423accfecfff5800254710e31aaab1e8e154fa3e
sha512: 82d86247d705b54d673ac57b0a5c90e6c4c686ad8fbfe688269c6ed1e004e6e1ef817fe3b129393b5f568d38332161ce5e8bdd5e3d5936ab707ed62adb9aab99
ssdeep: 12288:RQjQEMCYFzhC79lb3TS+E+gPa/10k1iV7:RpHCcNk3ptKs10
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CBB4FA282AE94929F1BBAF7D95F13496DA3EB6633717D74D04A102860723B41DDC0B3B
sha3_384: d6a7894d9ae09528f8ac73b21994ea38e4c82123c7a53b34812930a551d397746f12369f2411f1ee23c3bc5f9da8758c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-03-15 23:42:27


Version Info:

ProductName: vnaBX7m21dlmjSke8
CompanyName: MVm0vYGP
InternalName: QIq2GxX2rSF75dCuzFz4q8T0rSNz6.exe
LegalCopyright: L5H
Comments: ozwzdETqOK3QQzbUCSWViRnaZnug5
OriginalFilename: GKm6DSEArgsAxJ.exe
ProductVersion: 824.694.492.572
FileVersion: 593.738.682.774
Translation: 0x0409 0x0514

Backdoor:MSIL/DCRat.C!MTB also known as:

Bkav W32.AIDetectMalware.CS
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.86836
FireEye Generic.mg.7b66b0a16900e321
CAT-QuickHeal Trojan.MsilFC.S27416877
Skyhigh BehavesLike.Win32.AgentTesla.gm
McAfee PWS-FDKA!7B66B0A16900
Malwarebytes Generic.Malware.AI.DDS
VIPRE Trojan.GenericKDZ.86836
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanSpy:MSIL/SpyNoon.b2ec2e5a
K7GW Trojan ( 00592ff21 )
K7AntiVirus Trojan ( 00592ff21 )
VirIT Trojan.Win32.Injector.DCGZ
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Spy.Agent.DTR
APEX Malicious
ClamAV Win.Packed.Passwordstealera-9917697-0
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender Trojan.GenericKDZ.86836
Avast Win32:RATX-gen [Trj]
Tencent Trojan-Spy.Msil.Stealer.fd
Emsisoft Trojan.GenericKDZ.86836 (B)
F-Secure Heuristic.HEUR/AGEN.1371403
DrWeb Trojan.Siggen17.26510
Zillya Trojan.Agent.Win32.2825081
Trapmine malicious.moderate.ml.score
Sophos Troj/SpyNoon-A
SentinelOne Static AI – Malicious PE
MAX malware (ai score=88)
Jiangmin TrojanSpy.MSIL.cgla
Google Detected
Avira HEUR/AGEN.1371403
Varist W32/MSIL_Agent.CYZ.gen!Eldorado
Antiy-AVL Trojan[Spy]/MSIL.Agent
Kingsoft malware.kb.c.862
Microsoft Backdoor:MSIL/DCRat.C!MTB
Arcabit Trojan.Generic.D15334
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
GData Trojan.GenericKDZ.86836
AhnLab-V3 Trojan/Win.Spy.C4877870
Acronis suspicious
BitDefenderTheta Gen:NN.ZemsilF.36802.Em0@aOsWLBli
ALYac Trojan.GenericKDZ.86836
TACHYON Trojan-Spy/W32.DN-InfoStealer.494592
VBA32 Dropper.MSIL.gen
Cylance unsafe
Panda Trj/CI.A
Rising Backdoor.DCRat!1.E0D3 (CLASSIC)
Ikarus Trojan.MSIL.Spy
MaxSecure Trojan.Malware.121218.susgen
Fortinet MSIL/Agent.DTR!tr
AVG Win32:RATX-gen [Trj]
DeepInstinct MALICIOUS

How to remove Backdoor:MSIL/DCRat.C!MTB?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.