Trojan

What is “Trojan:MSIL/AgentTesla.DRQ!MTB”?

Malware Removal

The Trojan:MSIL/AgentTesla.DRQ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.DRQ!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.DRQ!MTB?



File Info:

name: A6C1D6C7F027EDD65FC2.mlw
path: /opt/CAPEv2/storage/binaries/96d8f77904387c5513e92733b0714987fdb476d6330c08c5404806b60f22af6f
crc32: 7927EC7A
md5: a6c1d6c7f027edd65fc284f1189dd5a6
sha1: 21f603ab1d5b62c1ee34369d462616388806dc1d
sha256: 96d8f77904387c5513e92733b0714987fdb476d6330c08c5404806b60f22af6f
sha512: ed36b9aed783a777d1e4337d92bdd6ccc1a2a32b21d9c6e4f371c05cbf44a93840c9bf46b043b6e6c6f2778c7fa5f50a77a285f5fd98a4933b1905db17b1c773
ssdeep: 24576:WIKjy/SYCpJ042WrhUAhIwpvYIQ35PhGtfl8noPC++wUX:kjASRN2Wrhlrhzemnj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16655231B2CE4B56FE56D56B0C363C0918F7CF0032D55F2B6689356BF673828ADA06A13
sha3_384: 3093d8d67097025f5daa2eeba083393399d1b4efc253435da763622ba2b40de9bae011c0b84696544a26203f0d0776af
ep_bytes: ff250020400000000000000000000000
timestamp: 2104-10-24 20:44:03


Version Info:

Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: KERBS4ULOG.exe
LegalCopyright:  
OriginalFilename: KERBS4ULOG.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan:MSIL/AgentTesla.DRQ!MTB also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Siggen16.2685
MicroWorld-eScanTrojan.GenericKD.38233451
FireEyeGeneric.mg.a6c1d6c7f027edd6
McAfeePWS-FCUF!A6C1D6C7F027
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.3645014
SangforTrojan.MSIL.Stealer.gen
K7AntiVirusTrojan ( 0058ba061 )
AlibabaTrojanSpy:MSIL/AgentTesla.dbb5c354
K7GWTrojan ( 0058ba061 )
BitDefenderThetaGen:NN.ZemsilF.34114.on0@aKcyTcp
SymantecMSIL.Packed.19
ESET-NOD32a variant of MSIL/Kryptik.ADRQ
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefenderTrojan.GenericKD.38233451
AvastWin32:MalwareX-gen [Trj]
Ad-AwareTrojan.GenericKD.38233451
EmsisoftTrojan.Crypt (A)
ComodoTrojWare.Win32.Agent.dwhdv@0
TrendMicroTROJ_FRS.0NA104LA21
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
SophosMal/Generic-S + Troj/MSIL-SDM
SentinelOneStatic AI – Suspicious PE
JiangminTrojanSpy.MSIL.cbrp
Antiy-AVLTrojan/Generic.ASMalwS.34EAAC9
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:MSIL/AgentTesla.DRQ!MTB
GridinsoftRansom.Win32.Sabsik.sa
ArcabitTrojan.Generic.D247656B
ViRobotTrojan.Win32.Z.Sabsik.1286144
GDataTrojan.GenericKD.38233451
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.C4830435
VBA32TScope.Trojan.MSIL
ALYacTrojan.GenericKD.38233451
MAXmalware (ai score=86)
MalwarebytesSpyware.Oski
TrendMicro-HouseCallTROJ_FRS.0NA104LA21
IkarusTrojan.MSIL.Inject
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/GenKryptik.FOPG!tr
AVGWin32:MalwareX-gen [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/AgentTesla.DRQ!MTB?

Trojan:MSIL/AgentTesla.DRQ!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment