Trojan

Trojan:MSIL/AgentTesla.AMCD!MTB (file analysis)

Malware Removal

The Trojan:MSIL/AgentTesla.AMCD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.AMCD!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.AMCD!MTB?



File Info:

name: A28CB78074F80F8AA064.mlw
path: /opt/CAPEv2/storage/binaries/44ab7e3cd2835765c5420ca7725830e78f7df65828db1274e528f9d6c6ca3c2e
crc32: 6BC177C4
md5: a28cb78074f80f8aa0642b15ffcd09cd
sha1: a55d469998f38c05b2fd6098bc3e893eb869eb78
sha256: 44ab7e3cd2835765c5420ca7725830e78f7df65828db1274e528f9d6c6ca3c2e
sha512: 85bd26eb0dfc0b5236c9509fcc1bfb0bdbbd522b8efafc481a9cdc69459726ac19b58a8aa58e1746ab8327f29f57bd627db2eafd48e23a2e54221958ef74ae77
ssdeep: 12288:+y3IU8S6eUduegJ31s93VCC9GHGKbjl9laUEJS64cs8hh6wxv5jHuy2I:+oItSAdr23S3cT99lvEMxcXru
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C5E412117BBCD7A6E6B257F95522891027BEBA277430DF0D5E8275CF2932B409062F23
sha3_384: 9a8d585478b2dc29d82fe387da63bb682446df82992f7b63f29d8483721b60d681f78d885a5df93945321e9da4c6f27c
ep_bytes: ff2500204000ffffffff000000000100
timestamp: 2062-07-16 09:00:40


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft Corporation
FileDescription: Shell Obsolete
FileVersion: 1.0.0.0
InternalName: CxVa.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: 
OriginalFilename: CxVa.exe
ProductName: Shell Obsolete
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.AMCD!MTB also known as:

BkavW32.AIDetectMalware.CS
LionicTrojan.Win32.Remcos.m!c
DrWebTrojan.MulDrop24.32075
MicroWorld-eScanTrojan.Generic.34488107
ClamAVWin.Packed.Filerepmalware-10019564-0
SkyhighBehavesLike.Win32.Generic.jc
McAfeeGenericRXWM-PQ!A28CB78074F8
MalwarebytesTrojan.MalPack.PNG.Generic
VIPRETrojan.Generic.34488107
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005ae9061 )
AlibabaBackdoor:MSIL/AgentTesla.4405e4d0
K7GWTrojan ( 005ae9061 )
ArcabitTrojan.Generic.D20E3F2B
BitDefenderThetaGen:NN.ZemsilCO.36680.Om0@a8ZjSZl
VirITTrojan.Win32.MSIL_Heur.A
SymantecScr.Malcode!gdn33
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Kryptik.AKJA
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Backdoor.MSIL.Remcos.gen
BitDefenderTrojan.Generic.34488107
NANO-AntivirusTrojan.Win32.Kryptik.kfhhqk
TencentMalware.Win32.Gencirc.13fa5cac
EmsisoftTrojan.Generic.34488107 (B)
F-SecureTrojan.TR/Dropper.MSIL.ngsna
TrendMicroTROJ_GEN.R002C0DLH23
FireEyeTrojan.Generic.34488107
SophosTroj/Krypt-ABH
SentinelOneStatic AI – Malicious PE
GoogleDetected
AviraTR/Dropper.MSIL.ngsna
Antiy-AVLTrojan/MSIL.GenKryptik
KingsoftMSIL.Backdoor.Remcos.gen
MicrosoftTrojan:MSIL/AgentTesla.AMCD!MTB
ZoneAlarmHEUR:Backdoor.MSIL.Remcos.gen
GDataTrojan.Generic.34488107
VaristW32/MSIL_Troj.CZL.gen!Eldorado
AhnLab-V3Trojan/Win.Injection.C5561951
VBA32TrojanLoader.MSIL.DaVinci.Heur
ALYacTrojan.Generic.34488107
MAXmalware (ai score=81)
DeepInstinctMALICIOUS
Cylanceunsafe
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.R002C0DLH23
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:wSw+J3lQJsgcR+6k2mfwPw)
YandexTrojan.Igent.b1nB1I.4
IkarusTrojan.MSIL.Crypt
MaxSecureTrojan.Malware.73696032.susgen
FortinetMSIL/Nekark.TIYVL!tr
AVGWin32:PWSX-gen [Trj]
AvastWin32:PWSX-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/AgentTesla.AMCD!MTB?

Trojan:MSIL/AgentTesla.AMCD!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment