Backdoor

Backdoor:MSIL/Remcos.DXAA!MTB removal instruction

Malware Removal

The Backdoor:MSIL/Remcos.DXAA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:MSIL/Remcos.DXAA!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Backdoor:MSIL/Remcos.DXAA!MTB?



File Info:

name: 93599F58923A6768501F.mlw
path: /opt/CAPEv2/storage/binaries/2aa5dbdfca727b54d217cb452c424d8b8a8fe071d6d9b3c0ee9eed6c1563ac16
crc32: C6D2F522
md5: 93599f58923a6768501f9ecdf8c780ae
sha1: db788c95e0b9c8f16e40d764073cce287a9c2b82
sha256: 2aa5dbdfca727b54d217cb452c424d8b8a8fe071d6d9b3c0ee9eed6c1563ac16
sha512: 445e59f509dddef93b39674c1abb5704d3f03251695b0d9636910744e9e58f4b258da4e9a275573bc6b2eecd1a1e3204e2ee9c90cbc9b8fe3d6bf9dd9a9288d3
ssdeep: 1536:zG5TRXgqtApbddN6sX98xO0Zy3kIMNmqqE:C51rcdGsN8zukIzVE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T117339E4C5BF9B0A9F6BF9972412260118379F9536A03939F6580B1310A377C6C947EFA
sha3_384: 66ff5bb2c43458155035f74550e20c28e0b6507cf966e5097a9b0341fa13622db3e8971097b80ac6dd782dcf2e929af7
ep_bytes: ff250020400000000000000000000000
timestamp: 2101-12-11 19:20:57


Version Info:

Translation: 0x0000 0x04b0
CompanyName: Ugemecudixoqaqeri
FileDescription: Ahataceraqakujol Aqagacurulecufiz Urowiqipol Imiqivifocusogeroko Ulehobulecuco Inomasefigavijuzowuko Okapetupivad.
FileVersion: 5.9.841.20
InternalName: Amihafaqikuzebafa
LegalCopyright: © 2027  Ugemecudixoqaqeri
OriginalFilename: Azivahexamosokoyizovu
ProductName: Upujine
ProductVersion: 5.9.841.20
Comments: Orocejoyiyeyati Itirozemigeri Iludepirok Ohuxejanenicakokocod.

Backdoor:MSIL/Remcos.DXAA!MTB also known as:

BkavW32.AIDetectMalware.CS
LionicTrojan.Win32.Agensla.i!c
DrWebTrojan.DownLoaderNET.931
MicroWorld-eScanTrojan.GenericKD.71626888
FireEyeGeneric.mg.93599f58923a6768
SkyhighArtemis!Trojan
ALYacTrojan.GenericKD.71626888
Cylanceunsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusRiskware ( 00584baa1 )
AlibabaBackdoor:MSIL/Remcos.98f11b7a
K7GWRiskware ( 00584baa1 )
Cybereasonmalicious.5e0b9c
ArcabitTrojan.Generic.D444F088
BitDefenderThetaGen:NN.ZemsilF.36744.dm0@aae5Mjki
VirITTrojan.Win32.Genus.VDT
SymantecDownloader
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.QII
CynetMalicious (score: 100)
APEXMalicious
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.71626888
AvastWin32:PWSX-gen [Trj]
TencentMalware.Win32.Gencirc.1401613e
EmsisoftTrojan.GenericKD.71626888 (B)
F-SecureTrojan.TR/Agent_AGen.ufzyx
VIPRETrojan.GenericKD.71626888
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
VaristW32/MSIL_Kryptik.KOS.gen!Eldorado
AviraTR/Agent_AGen.ufzyx
KingsoftMSIL.Trojan-PSW.Agensla.gen
XcitiumMalware@#f2y9jdxujnxb
MicrosoftBackdoor:MSIL/Remcos.DXAA!MTB
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
GDataTrojan.GenericKD.71626888
GoogleDetected
AhnLab-V3Trojan/Win.Generic.C5586738
McAfeeArtemis!93599F58923A
MAXmalware (ai score=88)
VBA32TScope.Trojan.MSIL
MalwarebytesTrojan.Crypt.MSIL.Generic
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.F0D1C00BC24
RisingStealer.Agensla!8.13266 (CLOUD)
IkarusTrojan.MSIL.Inject
MaxSecureTrojan.Malware.74499699.susgen
FortinetMSIL/Agent_AGen.BEE!tr.dldr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Backdoor:MSIL/Remcos.DXAA!MTB?

Backdoor:MSIL/Remcos.DXAA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment