Trojan

Trojan:MSIL/AgentTesla.COY!MTB removal

Malware Removal

The Trojan:MSIL/AgentTesla.COY!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.COY!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:MSIL/AgentTesla.COY!MTB?



File Info:

name: 920CBF97966402A7D01E.mlw
path: /opt/CAPEv2/storage/binaries/93f08f72c506507545fae3e2325db7fa81487518bcd947cce9ac1d7431a1011a
crc32: 4B32C04A
md5: 920cbf97966402a7d01ea99060825de0
sha1: cc1c37451661000f4614e5b851a207e98ee9c3a2
sha256: 93f08f72c506507545fae3e2325db7fa81487518bcd947cce9ac1d7431a1011a
sha512: 13ada70487acee6f9ba2b850b4b9779099ce23e6263651aad9bc80f832da4afd03e48e566bd114ce2372f449d43bab1223553c77775409d767d622801160c57f
ssdeep: 12288:DqMnixvVJ6BfJBiYHqYH1bIBx0NrfkyFZEWOhzNR02+A/X:DqMixmJRqYHBIwP01C
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F225B23C98FD6927C066CA76CBF4D827B004D9AF3226ADA554D757264353B8330D3A2E
sha3_384: 9c3d23822412dc3b591b6883305f563915d7ee73e58ba030b789b3477940099802ae57611621d0406797df62ccf72387
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-08-26 01:59:34


Version Info:

Translation: 0x0000 0x04b0
Comments: Home Inspector
CompanyName: Sears Homelife
FileDescription: KMM
FileVersion: 3.1.1.2
InternalName: ObjectHolderLi.exe
LegalCopyright: Copyright ©  Sears Homelife
LegalTrademarks: 
OriginalFilename: ObjectHolderLi.exe
ProductName: KMM
ProductVersion: 3.1.1.2
Assembly Version: 3.1.1.2

Trojan:MSIL/AgentTesla.COY!MTB also known as:

LionicTrojan.Win32.Agensla.i!c
Elasticmalicious (high confidence)
DrWebBackDoor.SpyBotNET.25
MicroWorld-eScanTrojan.GenericKD.37483244
FireEyeGeneric.mg.920cbf97966402a7
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
SkyhighPWS-FCUC!920CBF979664
McAfeePWS-FCUC!920CBF979664
MalwarebytesGeneric.Malware.AI.DDS
SangforInfostealer.MSIL.Agensla.gen
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 0058172f1 )
K7AntiVirusTrojan ( 0058172f1 )
ArcabitTrojan.Generic.D23BF2EC
VirITTrojan.Win32.MSIL_Heur.A
SymantecScr.Malcode!gdn30
ESET-NOD32a variant of MSIL/Kryptik.ACOY
CynetMalicious (score: 100)
APEXMalicious
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.37483244
SUPERAntiSpywareTrojan.Agent/GenericKD
AvastWin32:MalwareX-gen [Trj]
TencentMsil.Trojan-QQPass.QQRob.Dkjl
EmsisoftTrojan.GenericKD.37483244 (B)
F-SecureHeuristic.HEUR/AGEN.1309974
VIPRETrojan.GenericKD.37483244
TrendMicroTrojanSpy.MSIL.NEGASTEA.SME
SophosTroj/Krypt-BQ
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.PSW.MSIL.chha
WebrootW32.Trojan.Gen
VaristW32/MSIL_Kryptik.FIY.gen!Eldorado
AviraHEUR/AGEN.1309974
MAXmalware (ai score=100)
Antiy-AVLTrojan[PSW]/MSIL.Agensla
KingsoftWin32.PSWTroj.Undef.a
MicrosoftTrojan:MSIL/AgentTesla.COY!MTB
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
GDataTrojan.GenericKD.37483244
GoogleDetected
AhnLab-V3Infostealer/Win.Lokibot.R438928
VBA32Dropper.MSIL.gen
ALYacTrojan.GenericKD.37483244
Cylanceunsafe
PandaTrj/GdSda.A
TrendMicro-HouseCallTrojanSpy.MSIL.NEGASTEAL.SMG
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:hovGc72mAbjTX0Q4+PEsYA)
YandexTrojan.Igent.bWtuTf.24
IkarusTrojan.Inject
MaxSecureTrojan.Malware.74499699.susgen
FortinetMSIL/Kryptik.ACOY!tr
AVGWin32:MalwareX-gen [Trj]
DeepInstinctMALICIOUS

How to remove Trojan:MSIL/AgentTesla.COY!MTB?

Trojan:MSIL/AgentTesla.COY!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment