Trojan

Trojan:MSIL/AgentTesla.AEA!MTB information

Malware Removal

The Trojan:MSIL/AgentTesla.AEA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.AEA!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.AEA!MTB?



File Info:

name: 64B08CFA7F61C3D8C0AD.mlw
path: /opt/CAPEv2/storage/binaries/224f31dea1ffd2d72f002579912a7e3812b71eb7a3ebc7c956173f892df8e9ec
crc32: 29C4D0F1
md5: 64b08cfa7f61c3d8c0ad9523e1fb7472
sha1: de8b2d28bc0d6637feb01ad717c0e5c4c478ab89
sha256: 224f31dea1ffd2d72f002579912a7e3812b71eb7a3ebc7c956173f892df8e9ec
sha512: d96d3cfcd901e8b72c289e92b7e1b4c5efa1d4767e43749ee8df18648dcd2e02fb64cb709ead9077d190d76b0c9122a665bbdd64c1636ecb92148588c70fb125
ssdeep: 12288:qTkRRRRRERB71HgMZWhcvFMlfZfIdGpZjM9PiOAyRRwhqPyLa:kkRRRRRERrHgMZWhcvFsRwEp9M9zAeR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17484F1893A84F2DEC56FCF7599542C24A6607937671BE207610B11CEAB0E7E68E107F3
sha3_384: 2c3fc0074f2324af9265df1c5b50b2a9bf91d4fe3155322b030f505d76958d07bb683735d928ae3bf95239c7051cffd7
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-17 10:45:35


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Razer Inc.
FileDescription: RazerInstaller
FileVersion: 1.0.0.0
InternalName: CrossAppDomainDa.exe
LegalCopyright: Copyright ©  2021 Razer Inc. All rights reserved.
LegalTrademarks: 
OriginalFilename: CrossAppDomainDa.exe
ProductName: RazerInstaller
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.AEA!MTB also known as:

LionicTrojan.MSIL.Agensla.i!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.38575900
FireEyeGeneric.mg.64b08cfa7f61c3d8
CylanceUnsafe
SangforInfostealer.MSIL.Agensla.gen
K7AntiVirusTrojan ( 0058cf581 )
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 0058cf581 )
CrowdStrikewin/malicious_confidence_100% (W)
ArcabitTrojan.Generic.D24C9F1C
CyrenW32/MSIL_Kryptik.GKF.gen!Eldorado
SymantecScr.Malcode!gdn30
ESET-NOD32a variant of MSIL/Kryptik.AEAG
APEXMalicious
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.38575900
AvastWin32:PWSX-gen [Trj]
RisingTrojan.Generic/MSIL@AI.94 (RDM.MSIL:cqPj0Y5rKmwiBIgPxbpJdA)
Ad-AwareTrojan.GenericKD.38575900
EmsisoftTrojan.GenericKD.38575900 (B)
DrWebTrojan.Siggen16.34855
McAfee-GW-EditionBehavesLike.Win32.Generic.fc
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Dropper
AviraTR/Kryptik.vtulo
Antiy-AVLTrojan/MSIL.GenKryptik
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftTrojan:MSIL/AgentTesla.AEA!MTB
GDataTrojan.GenericKD.38575900
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.PWSX-gen.C4920790
McAfeePWS-FDFX!64B08CFA7F61
MAXmalware (ai score=87)
VBA32CIL.HeapOverride.Heur
MalwarebytesTrojan.MalPack.PNG.Generic
TrendMicro-HouseCallTROJ_GEN.R002H0CAH22
TencentMsil.Trojan-qqpass.Qqrob.Wpjk
YandexTrojan.Igent.bXjHJJ.8
IkarusTrojan.MSIL.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/CoinMiner.YII!tr
BitDefenderThetaGen:NN.ZemsilF.34160.ym0@a0dC!8b
AVGWin32:PWSX-gen [Trj]
Cybereasonmalicious.8bc0d6
PandaTrj/CI.A

How to remove Trojan:MSIL/AgentTesla.AEA!MTB?

Trojan:MSIL/AgentTesla.AEA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment