Trojan

Trojan:MSIL/AgentTesla.ABUT!MTB removal tips

Malware Removal

The Trojan:MSIL/AgentTesla.ABUT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.ABUT!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.ABUT!MTB?



File Info:

name: 30368A7D1AC4150FFABC.mlw
path: /opt/CAPEv2/storage/binaries/d5d4bfaf33f566fb6aad7d7a3b04a75424decc4045ca8c63f4302695e1dd59f2
crc32: 6B62A05B
md5: 30368a7d1ac4150ffabcceed6899991b
sha1: fa76923b446997d4401c71982d1c639fcfaf516a
sha256: d5d4bfaf33f566fb6aad7d7a3b04a75424decc4045ca8c63f4302695e1dd59f2
sha512: 6f30c711e199721a983daa323c6dce4354f37f4a9e08e79b8751db7aa7d45ce51e89b2fc4eae43385f3694ab2d2f3ffff1a1f685855992d759f9e874408ea5d3
ssdeep: 6144:hqK15T5ddSefzWNz9/p75I76lqj+AEW0H8Z8GGRheuUcr/TCnzxfeQmsbJopqeKl:tT9ffzWZ9ho+JWH3uUcr/Y1Jop0qN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T182E4053C09BDE22B91B8DAA5CFE58427F740E46B3115AEE6ACD347558316E1234C723E
sha3_384: eeb556a08a8ffc24c1303407da02f7cdcca290d744cebc8d8841a12075e20119542ef5c8ce10f6d78c3ed60a0b6c4fb1
ep_bytes: ff250020400000000000000000000000
timestamp: 2056-10-19 21:14:14


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft
FileDescription: Windows CLI
FileVersion: 11.0.2.0
InternalName: dAwh.exe
LegalCopyright: Copyright ©  Microsoft 2023
LegalTrademarks: 
OriginalFilename: dAwh.exe
ProductName: Windows CLI
ProductVersion: 11.0.2.0
Assembly Version: 11.0.2.0

Trojan:MSIL/AgentTesla.ABUT!MTB also known as:

BkavW32.AIDetectMalware.CS
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.99103
FireEyeGeneric.mg.30368a7d1ac4150f
SkyhighBehavesLike.Win32.Generic.jc
McAfeeGenericRXVW-SH!30368A7D1AC4
MalwarebytesCrypt.Trojan.MSIL.DDS
ZillyaTrojan.Taskun.Win32.6771
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005a45f51 )
AlibabaTrojan:MSIL/Taskun.e8ce20bb
K7GWTrojan ( 005a45f51 )
SymantecScr.Malcode!gdn34
ESET-NOD32a variant of MSIL/GenKryptik.GJFU
APEXMalicious
KasperskyHEUR:Trojan.MSIL.Taskun.gen
BitDefenderTrojan.GenericKDZ.99103
AvastWin32:PWSX-gen [Trj]
TencentMalware.Win32.Gencirc.13b5b780
TACHYONTrojan/W32.DN-Taskun.670208.B
EmsisoftTrojan.GenericKDZ.99103 (B)
GoogleDetected
DrWebTrojan.PackedNET.1982
VIPRETrojan.GenericKDZ.99103
SophosTroj/Krypt-XL
IkarusTrojan.MSIL.Inject
WebrootW32.Malware.Gen
VaristW32/MSIL_Troj.COF.gen!Eldorado
Antiy-AVLTrojan/MSIL.Taskun
KingsoftWin32.Troj.Unknown.a
MicrosoftTrojan:MSIL/AgentTesla.ABUT!MTB
XcitiumMalware@#9uxzav8h9oru
ArcabitTrojan.Generic.D1831F
ZoneAlarmHEUR:Trojan.MSIL.Taskun.gen
GDataTrojan.GenericKDZ.99103
AhnLab-V3Trojan/Win.PowerShell.R575009
BitDefenderThetaGen:NN.ZemsilF.36804.Om0@aqU3onc
ALYacTrojan.GenericKDZ.99103
MAXmalware (ai score=80)
VBA32TScope.Trojan.MSIL
Cylanceunsafe
PandaTrj/Chgt.AD
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:fuUFqmXHZeT09L5u+0vtDw)
YandexTrojan.Igent.bZ4R2g.1
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.74644571.susgen
FortinetMSIL/GenKryptik.FQQD!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
alibabacloudTrojan:MSIL/AgentTesla.ABUT!MTB

How to remove Trojan:MSIL/AgentTesla.ABUT!MTB?

Trojan:MSIL/AgentTesla.ABUT!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment