Backdoor:MSIL/WebShell.GMQ!MTB (file analysis)

The Backdoor:MSIL/WebShell.GMQ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/WebShell.GMQ!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Backdoor:MSIL/WebShell.GMQ!MTB?


File Info:
name: D651A70F779F673940D5.mlw
path: /opt/CAPEv2/storage/binaries/cc4c379a29f0bba77bd0c4450eea476e379f0aede08e8cf60ebc44ac593dca55
crc32: 1FA01E0F
md5: d651a70f779f673940d5595a2b1f0de7
sha1: 21b9e21a6c41ccc7d837a7be233e34282035c239
sha256: cc4c379a29f0bba77bd0c4450eea476e379f0aede08e8cf60ebc44ac593dca55
sha512: 7c789e3e353740881b6d2051cbb08b0ea6f7808cb2d0f6bd63751abe3ee2cb7a6bad7db97b392a2de0fc917186313faa665d5a27e3bff4bade6c8f890bd8800d
ssdeep: 3072:wbqdw3ESTfuktXSJMT+dsyZQUeiXUyWmrjebqqq2Vq:qektx/
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1A204C60733ED8614F1BEDA7951354C648B37B96A9835C15E0D9868ED1BF3F80C862FA2
sha3_384: abe541a73165dbd13f08ec66da4231c6dfcfbc4c13ff2be05b67041932ea14bfcff19357c8335d531b6303c04a34f017
ep_bytes: ff250020400000000000000000000000
timestamp: 2024-03-26 19:18:58

Version Info:
0: [No Data]

Backdoor:MSIL/WebShell.GMQ!MTB also known as:

Bkav	W32.AIDetectMalware.CS
AVG	Win32:BackdoorX-gen [Trj]
DrWeb	BackDoor.WebshellNET.8
MicroWorld-eScan	Gen:Variant.MSILHeracles.68689
FireEye	Gen:Variant.MSILHeracles.68689
Skyhigh	BehavesLike.Win32.Backdoor.cm
ALYac	Gen:Variant.MSILHeracles.68689
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005ab4bd1 )
K7GW	Trojan ( 005ab4bd1 )
CrowdStrike	win/malicious_confidence_100% (W)
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Webshell.AU
APEX	Malicious
Avast	Win32:BackdoorX-gen [Trj]
ClamAV	Win.Packed.Bulz-9891413-0
Kaspersky	HEUR:Backdoor.MSIL.WebShell.gen
BitDefender	Gen:Variant.MSILHeracles.68689
Tencent	Backdoor.MSIL.WebShell.16000622
Emsisoft	Gen:Variant.MSILHeracles.68689 (B)
F-Secure	Heuristic.HEUR/AGEN.1362733
Ikarus	Trojan.MSIL.Webshell
GData	MSIL.Trojan.PSE.10FRWX1
Google	Detected
Avira	HEUR/AGEN.1362733
MAX	malware (ai score=87)
Arcabit	Trojan.MSILHeracles.D10C51
ZoneAlarm	HEUR:Backdoor.MSIL.WebShell.gen
Microsoft	Backdoor:MSIL/WebShell.GMQ!MTB
Varist	W32/WebShell.D.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5388690
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Webshell.AZ!tr
alibabacloud	Backdoor:MSIL/Webshell.AU

How to remove Backdoor:MSIL/WebShell.GMQ!MTB?

Backdoor:MSIL/WebShell.GMQ!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X