Trojan

Trojan:MSIL/AgentTesla.EEC!MTB removal guide

Malware Removal

The Trojan:MSIL/AgentTesla.EEC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.EEC!MTB virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics

How to determine Trojan:MSIL/AgentTesla.EEC!MTB?



File Info:

name: B9E8039EF2881E772C33.mlw
path: /opt/CAPEv2/storage/binaries/410bbdd6148b1b9213dd7b0cdc9e2539804811bee38f23619bf5d99cd895e30d
crc32: 2BF5399F
md5: b9e8039ef2881e772c33b38afebbaf2c
sha1: 406ac949674ed85f4d6a5f6e25f010b0fda83c29
sha256: 410bbdd6148b1b9213dd7b0cdc9e2539804811bee38f23619bf5d99cd895e30d
sha512: 96a357e20530a81fcf85a76885d65a1d87645f7a6449ae69b27557f5fc11f8dcf2ac9f0cdfade1a46ad05652dc99effcc00649477d0e6894aa226c2bf8d50a74
ssdeep: 24576:06VOVHDMpOIhlZ/1dE/GV1FGB5TatqzlwtbnWdeeQzaWMlHjE8rMU8p4x2:0HMpOIhlt/E/qFU5TzC5nGMaWMxTojp4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1425501A8A0AB4596F10BC974253CF9B102B235E3E9C50D35676D3600CFEEF652E85A4F
sha3_384: e1b3d635ce9265995a16f0dfdc087643edaa9feeae9ac8517518f1c53bb89d5cbf3bf700f4891fc8795be63f0cb31411
ep_bytes: ff2500204000ab244363a9c2a6c33b37
timestamp: 2022-01-31 07:44:35


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Del Farm
FileDescription: ChatClient Chiropractor
FileVersion: 1.1
InternalName: TaiwanCalend.exe
LegalCopyright: Copyright © Del Farm
LegalTrademarks: 
OriginalFilename: TaiwanCalend.exe
ProductName: ChatClient Chiropractor
ProductVersion: 1.1
Assembly Version: 9.1.3.1

Trojan:MSIL/AgentTesla.EEC!MTB also known as:

Elasticmalicious (high confidence)
DrWebTrojan.PackedNET.1176
MicroWorld-eScanTrojan.GenericKD.38826746
FireEyeGeneric.mg.b9e8039ef2881e77
CAT-QuickHealTrojan.Agenttesla
ALYacTrojan.GenericKD.38826746
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.3686758
SangforInfostealer.MSIL.Agensla.gen
K7AntiVirusTrojan ( 0058db971 )
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 0058db971 )
Cybereasonmalicious.9674ed
CyrenW32/MSIL_Agent.CRM.gen!Eldorado
SymantecScr.Malcode!gdn30
ESET-NOD32a variant of MSIL/Kryptik.AEEC
TrendMicro-HouseCallTROJ_GEN.R03FC0DB322
Paloaltogeneric.ml
ClamAVWin.Packed.Filerepmalware-9938155-0
BitDefenderTrojan.GenericKD.38826746
AvastWin32:Trojan-gen
TencentMsil.Trojan-qqpass.Qqrob.Pjdo
Ad-AwareTrojan.GenericKD.38826746
SophosMal/Generic-S + Troj/MSIL-SHF
ComodoMalware@#3swh97i3fugl
F-SecureTrojan.TR/Kryptik.fahul
TrendMicroTROJ_GEN.R03FC0DB322
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
EmsisoftTrojan.Crypt (A)
IkarusTrojan-Dropper.MSIL.Agent
GDataTrojan.GenericKD.38826746
AviraTR/Kryptik.fahul
Antiy-AVLTrojan[PSW]/MSIL.Agensla
GridinsoftRansom.Win32.Sabsik.sa
ArcabitTrojan.Generic.D25072FA
ViRobotTrojan.Win32.Z.Kryptik.1348608.B
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
MicrosoftTrojan:MSIL/AgentTesla.EEC!MTB
CynetMalicious (score: 100)
AhnLab-V3Malware/Win.Generic.C4944294
McAfeeAgentTesla-FDFM!B9E8039EF288
MAXmalware (ai score=87)
VBA32TScope.Trojan.MSIL
MalwarebytesTrojan.Crypt.MSIL
APEXMalicious
YandexTrojan.Igent.bXoMyY.13
SentinelOneStatic AI – Suspicious PE
FortinetMSIL/Kryptik.AEEC!tr
AVGWin32:Trojan-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.74499699.susgen

How to remove Trojan:MSIL/AgentTesla.EEC!MTB?

Trojan:MSIL/AgentTesla.EEC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment