Backdoor

Backdoor:MSIL/WebShell.AI!MTB malicious file

Malware Removal

The Backdoor:MSIL/WebShell.AI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:MSIL/WebShell.AI!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Anomalous .NET characteristics

How to determine Backdoor:MSIL/WebShell.AI!MTB?



File Info:

name: 7F8667638EE1EED8A47F.mlw
path: /opt/CAPEv2/storage/binaries/b01933ed7e11708b72e6d307fe49e0a2d3b7f4bbd16ee6694a524524c8d124fb
crc32: BA3BFD2A
md5: 7f8667638ee1eed8a47f0f3b3830e51d
sha1: 200dfc908e07021197cdd9e255d8f0247f057d9e
sha256: b01933ed7e11708b72e6d307fe49e0a2d3b7f4bbd16ee6694a524524c8d124fb
sha512: 59914b46a5825132d8c2a8bd493627d0fdd7972ea3488fc27ed7c60b29581c07fad10ff0d8869d9667a50882ffb8c7fe0806115ad716bbcfc80ffa5582d51a5b
ssdeep: 384:mkj/snLQ3n6sTWqO52sdkezHfasSrkxG0:mkj/snLQ36sc524kEHytQN
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T17552C61BEBDCC763C5BE47B82170863183B4D607B853FB1A6EC51198BE937A08417AD6
sha3_384: 7f1f642fe2e4b8042c71174a49828f91d34fd4c657b2877741fe1849fa86ed27a50d12dcb4e453e52b3ba6626266a396
ep_bytes: ff250020001000000000000000000000
timestamp: 2024-02-22 16:25:47


Version Info:

0: [No Data]

Backdoor:MSIL/WebShell.AI!MTB also known as:

BkavW32.AIDetectMalware.CS
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.MSILHeracles.125130
ClamAVWin.Packed.Webshell-10013396-0
FireEyeGen:Variant.MSILHeracles.125130
SkyhighBehavesLike.Win32.Infected.lm
McAfeeRDN/Generic BackDoor
MalwarebytesTrojan.WebShell.MSIL
VIPREGen:Variant.MSILHeracles.125130
CrowdStrikewin/malicious_confidence_70% (W)
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of MSIL/Agent.EJA
KasperskyHEUR:Backdoor.MSIL.WebShell.gen
BitDefenderGen:Variant.MSILHeracles.125130
AvastWin32:BackdoorX-gen [Trj]
TACHYONBackdoor/W32.DN-WebShell.13824.I
EmsisoftGen:Variant.MSILHeracles.125130 (B)
F-SecureTrojan.TR/Agent.knfmb
DrWebBackDoor.WebshellNET.5
ZillyaTrojan.Agent.Win32.3839340
TrendMicroTROJ_GEN.R011C0DBO24
IkarusTrojan.MSIL.Agent
GDataGen:Variant.MSILHeracles.125130
VaristW32/MSIL_Agent.GWE.gen!Eldorado
AviraTR/Agent.knfmb
ArcabitTrojan.MSILHeracles.D1E8CA
ZoneAlarmHEUR:Backdoor.MSIL.WebShell.gen
MicrosoftBackdoor:MSIL/WebShell.AI!MTB
GoogleDetected
AhnLab-V3Backdoor/Win.WEBSHELL.C5576382
ALYacGen:Variant.MSILHeracles.125130
MAXmalware (ai score=86)
VBA32TScope.Trojan.MSIL
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R011C0DBO24
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetMSIL/Agent.EJA!tr
AVGWin32:BackdoorX-gen [Trj]

How to remove Backdoor:MSIL/WebShell.AI!MTB?

Backdoor:MSIL/WebShell.AI!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment