Trojan

Trojan:MSIL/AgentTesla.GAGA!MTB (file analysis)

Malware Removal

The Trojan:MSIL/AgentTesla.GAGA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.GAGA!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.GAGA!MTB?



File Info:

name: DF1B8E6B5BFF547E4033.mlw
path: /opt/CAPEv2/storage/binaries/cf102186a476a757efff6e829b5c2205814c86ef6d3c28f420eddce9a2b0cfa2
crc32: 0163371C
md5: df1b8e6b5bff547e4033e5ea6167d5ad
sha1: aa5e9530325a2b114f6401f56368b6f96e7ad1ee
sha256: cf102186a476a757efff6e829b5c2205814c86ef6d3c28f420eddce9a2b0cfa2
sha512: f3d81e3c982d50e5ec063513514d543a5bee43de3258a8abb0ada9b7757e0a48651c8d8564637ed31f35c92e9b6722d8787842c0118c5b2b969c8a6c5783d8b7
ssdeep: 24576:MFxgV10D1hkP55qvClnBeD7DA4uMe9IbUDHDl:egVWTkxWCRBePDAk7U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17205AE1BAF147708C5A3AAB4EE4BBDA2A7F61C1D3175D0783E657C0A4AFF301E51142A
sha3_384: dd28c28603e663678643c7d00a13858c6b02d7201ed3e3315182dd6fd8b0486b219c4674fa833371853422a5bf45d317
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-08-08 07:40:24


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Process Explorer
FileVersion: 1.0.0.0
InternalName: ProgIdRedirectionEn.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: ProgIdRedirectionEn.exe
ProductName: Process Explorer
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.GAGA!MTB also known as:

BkavW32.AIDetectMalware.CS
tehtrisGeneric.Malware
MicroWorld-eScanGen:Variant.Ransom.Loki.10465
FireEyeGeneric.mg.df1b8e6b5bff547e
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
SkyhighBehavesLike.Win32.Generic.bc
ALYacGen:Variant.Ransom.Loki.10465
MalwarebytesGeneric.Crypt.Trojan.DDS
ZillyaTrojan.Kryptik.Win32.3866554
SangforSpyware.Msil.AgentTesla.Vqlm
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanSpy:MSIL/AgentTesla.8f6b0ce7
K7GWTrojan ( 00596b771 )
K7AntiVirusTrojan ( 00596b771 )
BitDefenderThetaGen:NN.ZemsilF.36802.Wm0@amExydk
VirITTrojan.Win32.MSIL_Heur.A
SymantecScr.Malcode!gdn34
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Kryptik.AGAJ
APEXMalicious
ClamAVWin.Dropper.Nanocore-9963202-0
KasperskyHEUR:Trojan-Spy.MSIL.Noon.gen
BitDefenderGen:Variant.Ransom.Loki.10465
NANO-AntivirusTrojan.Win32.Noon.jrvkwv
AvastWin32:PWSX-gen [Trj]
TencentMsil.Trojan-Spy.Noon.Ocnw
EmsisoftGen:Variant.Ransom.Loki.10465 (B)
F-SecureHeuristic.HEUR/AGEN.1306091
DrWebTrojan.PackedNET.1480
VIPREGen:Variant.Ransom.Loki.10465
Trapminesuspicious.low.ml.score
SophosTroj/Krypt-OU
SentinelOneStatic AI – Malicious PE
JiangminTrojanSpy.MSIL.crtg
GoogleDetected
AviraHEUR/AGEN.1306091
VaristW32/MSIL_Agent.DSF.gen!Eldorado
Antiy-AVLGrayWare/MSIL.Kryptik.enu
Kingsoftmalware.kb.c.735
MicrosoftTrojan:MSIL/AgentTesla.GAGA!MTB
ArcabitTrojan.Ransom.Loki.D28E1
ZoneAlarmHEUR:Trojan-Spy.MSIL.Noon.gen
GDataGen:Variant.Ransom.Loki.10465
AhnLab-V3Trojan/Win.AgentTesla.C5220761
McAfeeGenericRXTW-ZO!DF1B8E6B5BFF
MAXmalware (ai score=80)
VBA32OScope.Trojan.MSIL.Remcos.gen
Cylanceunsafe
PandaTrj/GdSda.A
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:tVWGmE0GcWfuw4D7rOkAZQ)
IkarusTrojan.Inject
MaxSecureTrojan.Malware.73691310.susgen
FortinetMSIL/Kryptik.AGQB!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS

How to remove Trojan:MSIL/AgentTesla.GAGA!MTB?

Trojan:MSIL/AgentTesla.GAGA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment