Backdoor

Backdoor:MSIL/Remcos!atmn removal tips

Malware Removal

The Backdoor:MSIL/Remcos!atmn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:MSIL/Remcos!atmn virus can do?

  • Sample contains Overlay data
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • CAPE detected the AgentTeslaV2 malware family

How to determine Backdoor:MSIL/Remcos!atmn?



File Info:

name: 57B7B7539FE6F71EB54F.mlw
path: /opt/CAPEv2/storage/binaries/0d1ed59e919316243299cfbfc06c1bd5bdfe0185c8b2bbd926e3e35d64c7586e
crc32: 13E9FB9B
md5: 57b7b7539fe6f71eb54fffbf39dd190c
sha1: 2598384eb775a8c1dd448d90d9f4998addc0fb38
sha256: 0d1ed59e919316243299cfbfc06c1bd5bdfe0185c8b2bbd926e3e35d64c7586e
sha512: ec6d4464450ed0455180202bff6c1422bd317bfef502b28b446e0f5fec2b458da909774e24682e6191be0ae4b1f960bdd8b9344816c17346d0b06801944c0ce9
ssdeep: 6144:eemlS3OzPFZi/bBlwqq4aNoc/ILOCgCB19GFx7bhomTVI:eeB3oP0bz84aK/gromTVI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11654396D2B88BA02F73D593389D1666066F194834D22CB0F6EC41FFD7B527C92C4A396
sha3_384: 68df7daa2280af4edefb0ad84357f2989a0af610ec963e8c033343d05d7bb1419c39c0eee30fd6d3ed5a0690c7f1b266
ep_bytes: ff250020400000000000000000000000
timestamp: 1994-09-04 09:53:34


Version Info:

Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: FBLcwMDKAhALylQBDbHRksAufNoLru.exe
LegalCopyright:  
OriginalFilename: FBLcwMDKAhALylQBDbHRksAufNoLru.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Backdoor:MSIL/Remcos!atmn also known as:

BkavW32.AIDetectMalware.CS
DrWebBackDoor.SpyBotNET.17
MicroWorld-eScanTrojan.Agent.ESZV
SkyhighBehavesLike.Win32.MarsStealer.dh
McAfeePWS-FCOT!57B7B7539FE6
Cylanceunsafe
ZillyaTrojan.Agensla.Win32.13346
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:MSIL/Remcos.1c64de0c
K7GWTrojan ( 005ac7f11 )
K7AntiVirusTrojan ( 005ac7f11 )
BitDefenderThetaAI:Packer.7F6695D320
VirITTrojan.Win32.GenusT.DTHN
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Spy.AgentTesla.D
APEXMalicious
TrendMicro-HouseCallTrojanSpy.Win32.NEGASTEAL.SMTH
ClamAVWin.Malware.AgentTesla-7426372-1
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.a
BitDefenderTrojan.Agent.ESZV
SUPERAntiSpywareBackdoor.Bot/Variant
TencentMsil.Trojan-QQPass.QQRob.Cdhl
EmsisoftTrojan.Agent.ESZV (B)
F-SecureTrojan.TR/Dropper.Gen
VIPRETrojan.Agent.ESZV
TrendMicroTrojanSpy.Win32.NEGASTEAL.SMTH
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.57b7b7539fe6f71e
SophosMal/Generic-S
IkarusWorm.MSIL.Autorun
JiangminTrojan.PSW.MSIL.aelf
GoogleDetected
AviraTR/Dropper.Gen
VaristW32/MSIL_Kryptik.EWL.gen!Eldorado
Antiy-AVLTrojan[PSW]/MSIL.Agensla
Kingsoftmalware.kb.c.1000
MicrosoftBackdoor:MSIL/Remcos!atmn
ArcabitTrojan.Agent.ESZV
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.a
GDataTrojan.Agent.ESZV
AhnLab-V3Trojan/Win32.Remcos.R344419
VBA32Trojan.MSIL.AgentTesla.PInv.Heur
ALYacTrojan.Agent.ESZV
MAXmalware (ai score=100)
MalwarebytesAutoRun.Spyware.Stealer.DDS
PandaTrj/CI.A
RisingSpyware.AgentTesla!1.B864 (CLASSIC)
YandexTrojanSpy.Agent!fb9bw+n8IsE
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetMSIL/Agent.AES!tr.spy
DeepInstinctMALICIOUS
alibabacloudTrojan[dropper]:MSIL/Agenttesla

How to remove Backdoor:MSIL/Remcos!atmn?

Backdoor:MSIL/Remcos!atmn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment