What is “Trojan:MSIL/AgentTesla.EQU!MTB”?

The Trojan:MSIL/AgentTesla.EQU!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.EQU!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.EQU!MTB?


File Info:
name: AEF17DBEDF34F6946A91.mlw
path: /opt/CAPEv2/storage/binaries/23ef0e7820649e02ac2d95cb4754394ce45e167e5abe1940beeb5d8da1a640d0
crc32: C5C494BC
md5: aef17dbedf34f6946a91c214b1df874a
sha1: 7402b36b7352bb54a539eaced1bf2d12cea32167
sha256: 23ef0e7820649e02ac2d95cb4754394ce45e167e5abe1940beeb5d8da1a640d0
sha512: fd20aef01ae4f12ef1da1a84f7e9917c6226081af7954dca817de1c5aa63e84c124a1da603f81a120704f0d26a2ed3df1f7fa8759dcd271d5528add59d3b0cf9
ssdeep: 6144:PR7NEYoiXZrPZ01R1QykR55/DL53fCQxC2EbkvZZaBbenSuqIPA4j6k2GpLPuYMz:PY4Jrx3ykrdLkQUYBZOqn932G1PuYK1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A6D49DE28DB0254ED9659B38E0C3CCB0E5DDE158552E778874704B072E9D3C0DEDABAA
sha3_384: c7267b6829ba50ff30f0daa4fc6d1c7660cfd6c981b5e165062e8420c60014308b73657f7edeef9dc7e67a25c174df7c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-04-23 07:55:06

Version Info:
Translation: 0x0000 0x04b0
Comments: Direct3D Helper Module
CompanyName: 
FileDescription: D3DHelper
FileVersion: 1.0.0.0
InternalName: CE0z.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: CE0z.exe
ProductName: D3DHelper
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.EQU!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.AgentTesla.4!c
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
FireEye	Generic.mg.aef17dbedf34f694
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	BehavesLike.Win32.Generic.jh
McAfee	AgentTesla-FDFR!AEF17DBEDF34
Cylance	unsafe
Zillya	Trojan.Kryptik.Win32.3743720
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00591f7f1 )
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 00591f7f1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2FF0DB0
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn30
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AEWR
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.50269616
NANO-Antivirus	Trojan.Win32.Crypt.jzzshu
MicroWorld-eScan	Trojan.GenericKD.50269616
Tencent	Malware.Win32.Gencirc.10bed1a0
Sophos	Troj/MSIL-SSP
F-Secure	Heuristic.HEUR/AGEN.1309481
DrWeb	Trojan.Siggen17.47124
VIPRE	Trojan.GenericKD.50269616
TrendMicro	TROJ_FRS.0NA103DP22
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.GenericKD.50269616 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.amqaf
Webroot	W32.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1309481
Antiy-AVL	Trojan/MSIL.Crypt
Kingsoft	malware.kb.c.1000
Xcitium	Malware@#7fgaddm8asod
Microsoft	Trojan:MSIL/AgentTesla.EQU!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.50269616
Varist	W32/MSIL_Kryptik.FQW.gen!Eldorado
AhnLab-V3	Trojan/Win.FDFR.C5098502
BitDefenderTheta	Gen:NN.ZemsilF.36744.Nm0@aKRCq9
ALYac	Trojan.GenericKD.50269616
MAX	malware (ai score=82)
VBA32	Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes	Malware.AI.511224168
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_FRS.0NA103DP22
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:BidBdzm94uBG9BXU16RXOA)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	MSIL/Kryptik.AEVQ!tr
DeepInstinct	MALICIOUS

How to remove Trojan:MSIL/AgentTesla.EQU!MTB?

Trojan:MSIL/AgentTesla.EQU!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X