Trojan:MSIL/AgentTesla.AASN!MTB malicious file

The Trojan:MSIL/AgentTesla.AASN!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.AASN!MTB virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.AASN!MTB?


File Info:
name: 2F0DCF3B37E31529ED6A.mlw
path: /opt/CAPEv2/storage/binaries/aad78489a9cf31ab8a0fa445313688e971a78c10d4933c6a5b07150970834dc5
crc32: 70DEC5F9
md5: 2f0dcf3b37e31529ed6a5bfa3e9beb01
sha1: 10efc65b87abef021e50abf711cbe081f3909670
sha256: aad78489a9cf31ab8a0fa445313688e971a78c10d4933c6a5b07150970834dc5
sha512: 24aedbe83430f4cf738da128f7fcc73b6e8e682dd7879556c294b799cd314743f7648e95c78c6b8e7adc86c4dfd0b70a07a906ab6645286f0808c8b810e4c4c3
ssdeep: 12288:2voPbsPjIrKgfiSV6+KdMkYD8JdaGXC9Wrk0:2voz2EKdO6XdMkYwJoGy9WI0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D1A401A1327E6BA7D87A97F15805A5071FF14A2B5962F3068CEF70E36864F1016C2F27
sha3_384: 3aa082ea88e3bcd40cb2bd932816104fdde9572ccc7d3a98b31874103c610b6304024ba86cf281c1181566cc46b6aabb
ep_bytes: 
timestamp: 2075-09-24 14:28:09

Version Info:
0: [No Data]

Trojan:MSIL/AgentTesla.AASN!MTB also known as:

MicroWorld-eScan	Trojan.GenericKDZ.103338
Skyhigh	BehavesLike.Win32.Trojan.gc
McAfee	GenericRXWK-MZ!2F0DCF3B37E3
VIPRE	Trojan.GenericKDZ.103338
BitDefender	Trojan.GenericKDZ.103338
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Generic.D193AA
ESET-NOD32	a variant of MSIL/Kryptik_AGen.BLE
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:vnJ5rRIA5kurTLZihpgS+g)
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.PackedNET.2450
Zillya	Trojan.KryptikAGen.Win32.18516
FireEye	Trojan.GenericKDZ.103338
Emsisoft	Trojan.GenericKDZ.103338 (B)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=89)
Google	Detected
Kingsoft	malware.kb.c.997
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/AgentTesla.AASN!MTB
GData	MSIL.Trojan.PSE.9ZQFHF
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.AgentTesla.C5510055
ALYac	Trojan.GenericKDZ.103338
Malwarebytes	Malware.AI.2957778914
Ikarus	Trojan.MSIL.Agent
Fortinet	MSIL/Kryptik.BLE!tr

How to remove Trojan:MSIL/AgentTesla.AASN!MTB?

Trojan:MSIL/AgentTesla.AASN!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X