Categories: Backdoor

Backdoor:MSIL/Remcos!atmn removal tips

The Backdoor:MSIL/Remcos!atmn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:MSIL/Remcos!atmn virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous .NET characteristics
CAPE detected the AgentTeslaV2 malware family

How to determine Backdoor:MSIL/Remcos!atmn?


File Info:
name: 57B7B7539FE6F71EB54F.mlwpath: /opt/CAPEv2/storage/binaries/0d1ed59e919316243299cfbfc06c1bd5bdfe0185c8b2bbd926e3e35d64c7586ecrc32: 13E9FB9Bmd5: 57b7b7539fe6f71eb54fffbf39dd190csha1: 2598384eb775a8c1dd448d90d9f4998addc0fb38sha256: 0d1ed59e919316243299cfbfc06c1bd5bdfe0185c8b2bbd926e3e35d64c7586esha512: ec6d4464450ed0455180202bff6c1422bd317bfef502b28b446e0f5fec2b458da909774e24682e6191be0ae4b1f960bdd8b9344816c17346d0b06801944c0ce9ssdeep: 6144:eemlS3OzPFZi/bBlwqq4aNoc/ILOCgCB19GFx7bhomTVI:eeB3oP0bz84aK/gromTVItype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11654396D2B88BA02F73D593389D1666066F194834D22CB0F6EC41FFD7B527C92C4A396sha3_384: 68df7daa2280af4edefb0ad84357f2989a0af610ec963e8c033343d05d7bb1419c39c0eee30fd6d3ed5a0690c7f1b266ep_bytes: ff250020400000000000000000000000timestamp: 1994-09-04 09:53:34
Version Info:
Translation: 0x0000 0x04b0FileDescription:  FileVersion: 0.0.0.0InternalName: FBLcwMDKAhALylQBDbHRksAufNoLru.exeLegalCopyright:  OriginalFilename: FBLcwMDKAhALylQBDbHRksAufNoLru.exeProductVersion: 0.0.0.0Assembly Version: 0.0.0.0

Backdoor:MSIL/Remcos!atmn also known as:

Bkav	W32.AIDetectMalware.CS
DrWeb	BackDoor.SpyBotNET.17
MicroWorld-eScan	Trojan.Agent.ESZV
Skyhigh	BehavesLike.Win32.MarsStealer.dh
McAfee	PWS-FCOT!57B7B7539FE6
Cylance	unsafe
Zillya	Trojan.Agensla.Win32.13346
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:MSIL/Remcos.1c64de0c
K7GW	Trojan ( 005ac7f11 )
K7AntiVirus	Trojan ( 005ac7f11 )
BitDefenderTheta	AI:Packer.7F6695D320
VirIT	Trojan.Win32.GenusT.DTHN
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Spy.AgentTesla.D
APEX	Malicious
TrendMicro-HouseCall	TrojanSpy.Win32.NEGASTEAL.SMTH
ClamAV	Win.Malware.AgentTesla-7426372-1
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.a
BitDefender	Trojan.Agent.ESZV
SUPERAntiSpyware	Backdoor.Bot/Variant
Tencent	Msil.Trojan-QQPass.QQRob.Cdhl
Emsisoft	Trojan.Agent.ESZV (B)
F-Secure	Trojan.TR/Dropper.Gen
VIPRE	Trojan.Agent.ESZV
TrendMicro	TrojanSpy.Win32.NEGASTEAL.SMTH
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.57b7b7539fe6f71e
Sophos	Mal/Generic-S
Ikarus	Worm.MSIL.Autorun
Jiangmin	Trojan.PSW.MSIL.aelf
Google	Detected
Avira	TR/Dropper.Gen
Varist	W32/MSIL_Kryptik.EWL.gen!Eldorado
Antiy-AVL	Trojan[PSW]/MSIL.Agensla
Kingsoft	malware.kb.c.1000
Microsoft	Backdoor:MSIL/Remcos!atmn
Arcabit	Trojan.Agent.ESZV
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.a
GData	Trojan.Agent.ESZV
AhnLab-V3	Trojan/Win32.Remcos.R344419
VBA32	Trojan.MSIL.AgentTesla.PInv.Heur
ALYac	Trojan.Agent.ESZV
MAX	malware (ai score=100)
Malwarebytes	AutoRun.Spyware.Stealer.DDS
Panda	Trj/CI.A
Rising	Spyware.AgentTesla!1.B864 (CLASSIC)
Yandex	TrojanSpy.Agent!fb9bw+n8IsE
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.AES!tr.spy
DeepInstinct	MALICIOUS
alibabacloud	Trojan[dropper]:MSIL/Agenttesla