Categories: Backdoor

Backdoor:MSIL/Remcos.AQ!MTB (file analysis)

The Backdoor:MSIL/Remcos.AQ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:MSIL/Remcos.AQ!MTB virus can do?

  • Presents an Authenticode digital signature
  • Network activity detected but not expressed in API logs

How to determine Backdoor:MSIL/Remcos.AQ!MTB?


File Info:

crc32: 3B366D01md5: 262a1ed87aae9a2d67e4e8ee77af0472name: upload_filesha1: 8afd75e3ff43064d2cacc05cba27c5bc4cd90217sha256: 4e8319b60657f5cf0267967a37408e78f37569dea6fe24db2ddb49bb58cb9a04sha512: 88e234dbfe9c911cd7ef83544eee5795bb9690b5fa700131a1705391a0aae9c6e96b348f23c0094a7d15f39b90ff87d659f8889a8504683a7da32e32efa97438ssdeep: 768:j9NtoMQXep+L/UW0mJ0O45pYxb8b0zlPPUdrnT4K5zEASUl+Uf2hF:Tto3511J0O45Yb8boPCT4K5zEASUUUf8type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

LegalCopyright: xa9 x7ef4x513fx41f. All rights reserved.Assembly Version: 8.8.1.6FileVersion: 3.4.7.2CompanyName: x7ef4x7ef4x42bLegalTrademarks: x6770x6770x41fComments: x7ef4x513fx41f x6770x41fx65afProductName: x65afx513fx7ef4 x41fx41fx513fProductVersion: 8.8.1.6FileDescription: x513fx513fx65af x41fx6770x65afOriginalFilename: x65afx513fx7ef4 x41fx41fx513f.exeTranslation: 0x0409 0x0514

Backdoor:MSIL/Remcos.AQ!MTB also known as:

Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.44061640
McAfee Artemis!262A1ED87AAE
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan-Downloader ( 00570ee91 )
BitDefender Trojan.GenericKD.44061640
K7GW Trojan-Downloader ( 00570ee91 )
CrowdStrike win/malicious_confidence_60% (W)
Invincea Mal/Generic-S
Cyren W32/Trojan.HLCL-2128
Symantec Trojan Horse
APEX Malicious
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba TrojanPSW:MSIL/Agensla.d543d4e9
ViRobot Trojan.Win32.Z.Wacatac.83680
Ad-Aware Trojan.GenericKD.44061640
Emsisoft Trojan.GenericKD.44061640 (B)
F-Secure Trojan.TR/Dropper.MSIL.avtmf
DrWeb Trojan.DownloaderNET.94
McAfee-GW-Edition RDN/Generic Downloader.x
FireEye Generic.mg.262a1ed87aae9a2d
Sophos Mal/Generic-S
Webroot W32.Trojan.Dropper
Avira TR/Dropper.MSIL.avtmf
MAX malware (ai score=86)
Microsoft Backdoor:MSIL/Remcos.AQ!MTB
Arcabit Trojan.Generic.D2A053C8
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKD.44061640
ALYac Trojan.GenericKD.44061640
Malwarebytes Trojan.Crypt.MSIL.Generic
Panda Trj/GdSda.A
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.GWP
Tencent Msil.Trojan-downloader.Agent.Hoyk
Ikarus Trojan-Downloader.MSIL.Agent
Fortinet Malicious_Behavior.SB
AVG Win32:DangerousSig [Trj]
Avast Win32:DangerousSig [Trj]
MaxSecure Trojan.Malware.74499699.susgen

How to remove Backdoor:MSIL/Remcos.AQ!MTB?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Win32.Backdoor.Agent.A information

The Win32.Backdoor.Agent.A is considered dangerous by lots of security experts. When this infection is active,…

30 mins ago

Generic.Dacic.94CCEEA9.A.5494E6E2 (B) removal tips

The Generic.Dacic.94CCEEA9.A.5494E6E2 (B) is considered dangerous by lots of security experts. When this infection is…

31 mins ago

Should I remove “Win32/Agent_AGen.DMX”?

The Win32/Agent_AGen.DMX is considered dangerous by lots of security experts. When this infection is active,…

36 mins ago

What is “HackTool:Win32/NetCatTool!MTB”?

The HackTool:Win32/NetCatTool!MTB is considered dangerous by lots of security experts. When this infection is active,…

36 mins ago

Malware.AI.1247929956 information

The Malware.AI.1247929956 is considered dangerous by lots of security experts. When this infection is active,…

40 mins ago

Packed.Win32.Krap.an information

The Packed.Win32.Krap.an is considered dangerous by lots of security experts. When this infection is active,…

45 mins ago