Backdoor:MSIL/Webshell.BB!MTB removal tips

The Backdoor:MSIL/Webshell.BB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/Webshell.BB!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Backdoor:MSIL/Webshell.BB!MTB?


File Info:
name: 7821AD151D2F7C9E144C.mlw
path: /opt/CAPEv2/storage/binaries/11e7a24742f0c226cc345fb75ca5c4e0b5f80700a8e2894bc69458c01948d886
crc32: 26B146F3
md5: 7821ad151d2f7c9e144cc96bdcc0f48e
sha1: a0d411d3ad25b00ad1789d41d8200d3db89217f3
sha256: 11e7a24742f0c226cc345fb75ca5c4e0b5f80700a8e2894bc69458c01948d886
sha512: b32c25ff3a08cfcbfe12c9980301a9be7837ab5664ce2b35a958c462c12bf087ccc788901d76b9112561c7b8eb6a02e760729886e945ce11fd7f05443d90679c
ssdeep: 384:T1w+lE/rVsfLePg1sD2dTmxOtKX7Lt4TpT:5blE/mfLwuOiKxOtKne9
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T17952C82AAB988D13C6BBD375A7B29604C5B695070556CF1EBDDCA1C61F7330802A2FD8
sha3_384: 0a16027bf94e27eb8106c0fc773c53fda48b18e37e27ae6c35e9e87e8f55830db0840b809b9b48e7418cd508539f4319
ep_bytes: ff250020001000000000000000000000
timestamp: 2024-03-03 18:19:23

Version Info:
0: [No Data]

Backdoor:MSIL/Webshell.BB!MTB also known as:

Bkav	W32.AIDetectMalware.CS
AVG	Win32:BackdoorX-gen [Trj]
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.MSILHeracles.61452
FireEye	Gen:Variant.MSILHeracles.61452
Skyhigh	GenericRXWN-NY!7821AD151D2F
McAfee	GenericRXWN-NY!7821AD151D2F
Malwarebytes	Trojan.WebShell.MSIL
Zillya	Trojan.Webshell.Win32.17416
K7AntiVirus	Trojan ( 005b19ee1 )
K7GW	Trojan ( 005b19ee1 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Webshell.EV
ClamAV	Win.Packed.Webshell-10016062-0
Kaspersky	HEUR:Backdoor.MSIL.WebShell.gen
BitDefender	Gen:Variant.MSILHeracles.61452
Avast	Win32:BackdoorX-gen [Trj]
F-Secure	Trojan.TR/Dropper.MSIL.Gen
DrWeb	BackDoor.WebshellNET.9
VIPRE	Gen:Variant.MSILHeracles.61452
TrendMicro	TROJ_GEN.R011C0DC524
Emsisoft	Gen:Variant.MSILHeracles.61452 (B)
Ikarus	Trojan.MSIL.Webshell
Varist	W32/WebShell.E.gen!Eldorado
Avira	TR/Dropper.MSIL.Gen
Microsoft	Backdoor:MSIL/Webshell.BB!MTB
Arcabit	Trojan.MSILHeracles.DF00C
ZoneAlarm	HEUR:Backdoor.MSIL.WebShell.gen
GData	MSIL.Trojan.PSE.14W6LGL
Google	Detected
AhnLab-V3	Backdoor/Win.WEBSHELL.C5557106
ALYac	Gen:Variant.MSILHeracles.61452
MAX	malware (ai score=80)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R011C0DC524
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Webshell.EE!tr

How to remove Backdoor:MSIL/Webshell.BB!MTB?

Backdoor:MSIL/Webshell.BB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X