Trojan

What is “Trojan:MSIL/AgentTesla.COX!MTB”?

Malware Removal

The Trojan:MSIL/AgentTesla.COX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.COX!MTB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • NtSetInformationThread: attempt to hide thread from debugger
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Executable file is packed/obfuscated with Themida
  • Authenticode signature is invalid
  • Checks for the presence of known windows from debuggers and forensic tools
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key

How to determine Trojan:MSIL/AgentTesla.COX!MTB?



File Info:

name: 85018475747252A2F5F1.mlw
path: /opt/CAPEv2/storage/binaries/1ecde301c58c104f87ee14162e221ab34ed8e77f0e1f04405336f379244f950e
crc32: 86A71FE5
md5: 85018475747252a2f5f1c702d95b1e20
sha1: 21d42f6fd2a9f6243d3ba1693863edfb94ab51c4
sha256: 1ecde301c58c104f87ee14162e221ab34ed8e77f0e1f04405336f379244f950e
sha512: 517e3d734bde4b95c0eb919db60540986fb9c26df4f0acb388a9a54e5bfe6a6f2ffcc62d2b13fa5a04738a8615b73c55916ca64da656150534d47f734e853b6c
ssdeep: 49152:qG+OHPsm3/JCdemJGhOKNBHk60MarKwo16hhkGwwu6CeFQo:Xb3UdIO40MeKwZhhpbu6nQo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19EB512E3B7EC6201D17CDCF288AA0072EBF191879B2F9D84771C9B595A723C8065539E
sha3_384: 2f7186a23812bb043b8c7071518c5d81d71040237019d3b1654ba8f73d4d927a3369f0ca87ec5360209380bd1fdc8e4c
ep_bytes: e84b0100005389e3538b73088b7b10fc
timestamp: 2021-09-07 08:43:39


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: ConsolePokerGame
FileVersion: 1.0.0.0
InternalName: DecoderFallba.exe
LegalCopyright: Copyright ©  2016
LegalTrademarks: 
OriginalFilename: DecoderFallba.exe
ProductName: ConsolePokerGame
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.COX!MTB also known as:

BkavW32.AIDetect.malware1
LionicTrojan.MSIL.Taskun.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.861740
FireEyeGeneric.mg.85018475747252a2
McAfeeArtemis!850184757472
MalwarebytesSpyware.RedLineStealer
ZillyaTrojan.Taskun.Win32.4824
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005822aa1 )
BitDefenderGen:Variant.Razy.861740
K7GWTrojan ( 005822aa1 )
Cybereasonmalicious.fd2a9f
CyrenW32/Trojan.ANLW-0427
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.Themida.HYN
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.MSIL.Taskun.ae
AlibabaTrojan:Win32/starter.ali1000139
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
AvastWin32:Trojan-gen
TencentMsil.Trojan.Taskun.Dxmf
Ad-AwareGen:Variant.Razy.861740
SophosMal/Generic-S
F-SecureTrojan.TR/Redcap.ckhvb
DrWebTrojan.Inject4.19548
TrendMicroTROJ_GEN.R002C0WJ521
McAfee-GW-EditionBehavesLike.Win32.Trojan.vc
EmsisoftGen:Variant.Razy.861740 (B)
IkarusTrojan.MSIL.RedLine
GDataGen:Variant.Razy.861740
JiangminTrojan.MSIL.ajnvq
WebrootW32.Trojan.Gen
AviraTR/Redcap.ckhvb
MAXmalware (ai score=100)
KingsoftWin32.Heur.KVMH008.a.(kcloud)
GridinsoftRansom.Win32.Wacatac.oa
MicrosoftTrojan:MSIL/AgentTesla.COX!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R429793
VBA32BScope.Trojan.Wacatac
CylanceUnsafe
TrendMicro-HouseCallTROJ_GEN.R002C0WJ521
RisingTrojan.Generic@ML.96 (RDMK:KlP/TDXTaNG1zcSEKsNs0A)
YandexTrojan.Taskun!YAH40hwflJw
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/PossibleThreat
BitDefenderThetaGen:NN.ZexaF.34114.uE0@a4MGHThi
AVGWin32:Trojan-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/AgentTesla.COX!MTB?

Trojan:MSIL/AgentTesla.COX!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment