Trojan:MSIL/AgentTesla.BOC!MTB information

The Trojan:MSIL/AgentTesla.BOC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.BOC!MTB virus can do?

Presents an Authenticode digital signature
Network activity detected but not expressed in API logs

How to determine Trojan:MSIL/AgentTesla.BOC!MTB?


File Info:
crc32: 86382734
md5: 0160978a7835d130f3ce966df506ddf2
name: 0160978A7835D130F3CE966DF506DDF2.mlw
sha1: 625805134e3b1c6d542bd6c4636d9a0783732f68
sha256: 7eb0365d91d0933ba2ca948507764aec29f9c7596fb31826d5721a6b8cb0ebcb
sha512: c05a1b83b66099d63a86e9e35276898ce6c52a80099aab20e238cf1fd5b360fc9baacb1f8f3c825c33fc7cb0971daae5fa919be63e07f8fa3b9d10027675a781
ssdeep: 6144:X/SzFt6unRFfUMbz1OuI+w0NDuJ+QOl651CPbgWy/pQEZ:XKNRFfUMXgUrND6+6rCPUh/qEZ
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright (C) 2008 Realtek Semiconductor Corp.
Assembly Version: 284.421.605.927
InternalName: SqlWorkflowPersistenceService.exe
FileVersion: 918.28.177.219
CompanyName: Realtek Semiconductor Corp.
Comments: Installer for Lenovo System
ProductName: CHCFG
ProductVersion: 918.28.177.219
FileDescription: CHCFG
OriginalFilename: SqlWorkflowPersistenceService.exe

Trojan:MSIL/AgentTesla.BOC!MTB also known as:

K7AntiVirus	Trojan ( 0057e3d71 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.37129442
Cylance	Unsafe
Sangfor	Trojan.MSIL.AgentTesla.BOC
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/AgentTesla.1f0752f6
K7GW	Trojan ( 0057e3d71 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ABOC
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
BitDefender	Trojan.GenericKD.37129442
MicroWorld-eScan	Trojan.GenericKD.37129442
Ad-Aware	Trojan.GenericKD.37129442
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34758.1m2@aOfR67
McAfee-GW-Edition	PWS-FDAD!0160978A7835
FireEye	Trojan.GenericKD.37129442
Emsisoft	Trojan.GenericKD.37129442 (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Kryptik.ifdnd
Microsoft	Trojan:MSIL/AgentTesla.BOC!MTB
GData	Win32.Worm.LNKSpread.MAYQ7H
AhnLab-V3	Trojan/Win.AgentTesla.C4532311
McAfee	PWS-FDAD!0160978A7835
MAX	malware (ai score=87)
Malwarebytes	Malware.AI.1989431142
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.ABOC!tr
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml

How to remove Trojan:MSIL/AgentTesla.BOC!MTB?

Trojan:MSIL/AgentTesla.BOC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X