Backdoor:MSIL/WebShell.AH!MTB removal tips

The Backdoor:MSIL/WebShell.AH!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/WebShell.AH!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Backdoor:MSIL/WebShell.AH!MTB?


File Info:
name: 79466171F278D2F2E9F1.mlw
path: /opt/CAPEv2/storage/binaries/273fcd3c66314dc79df65f600ad782908a5c963442bdd76c62584c871001f390
crc32: B1AF0278
md5: 79466171f278d2f2e9f19e0db4e3522f
sha1: d80fbd8967706a0b04d8f32819b65a9f14ca2178
sha256: 273fcd3c66314dc79df65f600ad782908a5c963442bdd76c62584c871001f390
sha512: b1598e12a6aedfd24307e11b18be3016618cae88dcd40e239f042a905289755a4f5dd472bc774fccd7da4285c07fc7902bc8ec94bb8a2105d4cd023c8109b3ea
ssdeep: 6144:+TPiYdvslrpazqqQFH5mcupYLeOkzTo2jSvlpABKbrKbY1PkwKL1TxDBJhTAhGRR:KdvsRpazqDOp
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T15344F84A32E58A21E9BA9B7995720510C777B803A436D20E3DECA4ED1F73B41C417FA7
sha3_384: 264eaba18437da377499b1b803961ddea3e306658e4663e687ee083e4638921c7ce11bfcdf4aa72403f5941b12200ca0
ep_bytes: ff250020400000000000000000000000
timestamp: 2024-02-25 02:21:14

Version Info:
0: [No Data]

Backdoor:MSIL/WebShell.AH!MTB also known as:

Bkav	W32.AIDetectMalware.CS
MicroWorld-eScan	Gen:Variant.MSILHeracles.118220
FireEye	Gen:Variant.MSILHeracles.118220
Skyhigh	BehavesLike.Win32.Infected.dm
McAfee	Artemis!79466171F278
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.MSILHeracles.118220
CrowdStrike	win/malicious_confidence_90% (W)
K7GW	Trojan ( 005ab4bd1 )
K7AntiVirus	Trojan ( 005ab4bd1 )
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Webshell.AU
APEX	Malicious
ClamAV	Win.Packed.Generickdz-9941382-0
Kaspersky	HEUR:Backdoor.MSIL.WebShell.gen
BitDefender	Gen:Variant.MSILHeracles.118220
Avast	Win32:BackdoorX-gen [Trj]
F-Secure	Backdoor.BDC/AspxShell.G
DrWeb	BackDoor.WebshellNET.8
TrendMicro	TROJ_GEN.R011C0DBQ24
Emsisoft	Gen:Variant.MSILHeracles.118220 (B)
Ikarus	Trojan.MSIL.Webshell
GData	MSIL.Trojan.PSE.4C3LYT
Google	Detected
Avira	BDC/AspxShell.G
Varist	W32/WebShell.J.gen!Eldorado
Arcabit	Trojan.MSILHeracles.D1CDCC
ZoneAlarm	HEUR:Backdoor.MSIL.WebShell.gen
Microsoft	Backdoor:MSIL/WebShell.AH!MTB
AhnLab-V3	Trojan/Win.Generic.C5528305
ALYac	Gen:Variant.MSILHeracles.118220
MAX	malware (ai score=81)
TrendMicro-HouseCall	TROJ_GEN.R011C0DBQ24
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Webshell.AZ!tr
AVG	Win32:BackdoorX-gen [Trj]

How to remove Backdoor:MSIL/WebShell.AH!MTB?

Backdoor:MSIL/WebShell.AH!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X