Trojan

Trojan:MSIL/AgentTesla.EGC!MTB (file analysis)

Malware Removal

The Trojan:MSIL/AgentTesla.EGC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.EGC!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.EGC!MTB?



File Info:

name: 43F96296C945462B8210.mlw
path: /opt/CAPEv2/storage/binaries/0e4bb24b6acd34e75e07882e19b700eec8fcb6e0308e20021364694736358da4
crc32: C03F3AFC
md5: 43f96296c945462b8210bf8aec9eb73b
sha1: 04e607c244bf4efa29964bd23039fc3f02b5b1fc
sha256: 0e4bb24b6acd34e75e07882e19b700eec8fcb6e0308e20021364694736358da4
sha512: 7f7da6411b3323b4b99c72ea355382fa491de5aa9539f7da9ef9c2275ade0cb61ec2de10e2a53437659c959fd35c588dff59e03ddab6eb1299ddf13f7a7c0654
ssdeep: 12288:JYFzfyQk7VmrJRkni7bx0eoXxvua7djsWzz7AOXknI+sBE2rG6Kal8rLvY:udfmB+RkiB/oXBNsmPAOIf0drIO8XY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19D0501206BAC877AE93A53F46438423613753C592162DF0E8DE1BDCF3A767821415FAB
sha3_384: c69f7018a2f3e3e6ab1b50cad94b5bcd94b4dc2116c1b55717be30194557959dbc7251018a61382beb123831d056560c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-02-10 03:59:04


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: General Titles, Inc.
FileDescription: CoreLab Desktop
FileVersion: 1.0.0.0
InternalName: CompoundA.exe
LegalCopyright: Copyright © 2022 General Workings, Inc.
LegalTrademarks: 
OriginalFilename: CompoundA.exe
ProductName: CoreLab Desktop
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.EGC!MTB also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Multi.Generic.4!c
MicroWorld-eScanTrojan.GenericKDZ.83601
FireEyeGeneric.mg.43f96296c945462b
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
McAfeeAgentTesla-FDGQ!43F96296C945
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0058e38c1 )
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 0058e38c1 )
Cybereasonmalicious.244bf4
CyrenW32/MSIL_Agent.CSJ.gen!Eldorado
SymantecScr.Malcode!gdn30
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Kryptik.AEGB
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Packed.Generickdz-9940206-0
KasperskyHEUR:Trojan.MSIL.Taskun.gen
BitDefenderTrojan.GenericKDZ.83601
AvastWin32:MalwareX-gen [Trj]
TencentMsil.Trojan.Taskun.Peqb
Ad-AwareTrojan.GenericKDZ.83601
EmsisoftTrojan.Crypt (A)
ComodoMalware@#1vw84mr2do2z8
DrWebTrojan.Siggen16.42163
VIPRETrojan.GenericKDZ.83601
TrendMicroTROJ_GEN.R002C0DBD22
McAfee-GW-EditionAgentTesla-FDGQ!43F96296C945
Trapminesuspicious.low.ml.score
SophosMal/Generic-S + Troj/MSIL-SIY
SentinelOneStatic AI – Malicious PE
JiangminTrojan.MSIL.amddb
AviraTR/Kryptik.hwysp
Antiy-AVLTrojan/Generic.ASMalwS.7035
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:MSIL/AgentTesla.EGC!MTB
ZoneAlarmHEUR:Trojan.MSIL.Taskun.gen
GDataTrojan.GenericKDZ.83601
CynetMalicious (score: 100)
AhnLab-V3Malware/Win.Generic.C4962076
ALYacTrojan.GenericKDZ.83601
MAXmalware (ai score=81)
VBA32Trojan.Sabsik.FL
MalwarebytesSpyware.PasswordStealer
TrendMicro-HouseCallTROJ_GEN.R002C0DBD22
RisingTrojan.Kryptik!8.8 (CLOUD)
IkarusTrojan.MSIL.Inject
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/Kryptik.AEGB!tr
AVGWin32:MalwareX-gen [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/AgentTesla.EGC!MTB?

Trojan:MSIL/AgentTesla.EGC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment