Backdoor:MSIL/DCRat.D!MTB removal tips

The Backdoor:MSIL/DCRat.D!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/DCRat.D!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Backdoor:MSIL/DCRat.D!MTB?


File Info:
name: 99046A8904BAF170C015.mlw
path: /opt/CAPEv2/storage/binaries/09df0ef33a0f07b4d7d19a7da2957d1a3a373806417ac0f24ba83047e62968be
crc32: 91778D4C
md5: 99046a8904baf170c015035b8aa42f3c
sha1: bf35a68065173078e7b0d28b935fdb3dc91e1d24
sha256: 09df0ef33a0f07b4d7d19a7da2957d1a3a373806417ac0f24ba83047e62968be
sha512: b67efa50fde0591e6d3f0142eebcc688b8de272cddb0f9955321efd761262e778556b2fb414b3352dc3939b712b3408826b3382804f927e5f7f6dcffd81ed015
ssdeep: 12288:EDUniQUgES7Sro+Jad4diqk9ydepvWYRMIFYqURMGLxwlqj5Oqn4:sTQUgEc3qk9ydep+Y6xwlcM+4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E53517123A4EDD02C0291A37C9DF50B907ACBD417B66DA1A7E9F33AC60527A74D0E1DE
sha3_384: 8ead1731998632241ade85a9c1b8cc7ef975cf00937d70353bffdf3c48b3ebbd77057d37abf784d2c47741dcc90f0ee1
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-07-27 15:30:44

Version Info:
CompanyName: 
ProductName: FileZilla
FileDescription: 
InternalName: FZSFTP
OriginalFilename: FZSFTP
FileVersion: 
ProductVersion: 
LegalCopyright: Copyright © 2004-2020 Tim Kosse,   1997-2019 Simon Tatham.
PrivateBuild: Unidentified build
Translation: 0x0809 0x04b0

Backdoor:MSIL/DCRat.D!MTB also known as:

Lionic	Trojan.MSIL.LightStone.m!c
MicroWorld-eScan	Trojan.MSIL.Basic.8.Gen
ClamAV	Win.Malware.Uztuby-9848412-0
FireEye	Generic.mg.99046a8904baf170
McAfee	GenericRXSJ-UK!99046A8904BA
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.MSIL.Basic.8.Gen
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Backdoor:MSIL/SpyNoon.9a1bf2db
K7GW	Spyware ( 0057a0d21 )
K7AntiVirus	Spyware ( 0057a0d21 )
VirIT	Trojan.Win32.MSIL_Heur.B
Cyren	W32/MSIL_Agent.LQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Spy.Agent.DEK
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.LightStone.gen
BitDefender	Trojan.MSIL.Basic.8.Gen
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Backdoor.Lightstone.Tzfl
Emsisoft	Trojan-Spy.Agent (A)
F-Secure	Heuristic.HEUR/AGEN.1323340
DrWeb	BackDoor.QuasarNET.5
Zillya	Backdoor.LightStone.Win32.1052
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Trapmine	suspicious.low.ml.score
Sophos	Mal/SpyNoon-A
SentinelOne	Static AI – Malicious PE
GData	Trojan.MSIL.Basic.8.Gen
Avira	HEUR/AGEN.1323340
Antiy-AVL	Trojan[Backdoor]/MSIL.LightStone
Arcabit	Trojan.MSIL.Basic.8.Gen
ZoneAlarm	HEUR:Backdoor.MSIL.LightStone.gen
Microsoft	Backdoor:MSIL/DCRat.D!MTB
Google	Detected
AhnLab-V3	Trojan/Win.DC.C4552416
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36348.dr0@aGVBE3ai
ALYac	Trojan.MSIL.Basic.8.Gen
MAX	malware (ai score=80)
VBA32	TScope.Trojan.MSIL
Cylance	unsafe
Panda	Trj/FakeST.A
Rising	Backdoor.LightStone!8.1142E (CLOUD)
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.74703599.susgen
Fortinet	MSIL/Agent.CVT!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Backdoor:MSIL/DCRat.D!MTB?

Backdoor:MSIL/DCRat.D!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X