Trojan

Trojan:MSIL/AgentTesla.JNC!MTB removal tips

Malware Removal

The Trojan:MSIL/AgentTesla.JNC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.JNC!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Network activity detected but not expressed in API logs
  • Binary compilation timestomping detected

Related domains:

wpad.local-net

How to determine Trojan:MSIL/AgentTesla.JNC!MTB?



File Info:

name: 6B17243107B6F3C4F185.mlw
path: /opt/CAPEv2/storage/binaries/63d641c690314adb2a82a4ad66aec75b72a67f7c160b03bd4b2f5716c90cf3ed
crc32: 2D84F1CC
md5: 6b17243107b6f3c4f185084219f9941d
sha1: 1147aefd987fe7aa27dbad3f030d70b5c80a48c1
sha256: 63d641c690314adb2a82a4ad66aec75b72a67f7c160b03bd4b2f5716c90cf3ed
sha512: 059f9f3b6d8cb34287d3ac751d295051797efa228ae1cf56b9b560c43bbc401eb7382ec9f212bef7895924de4f66adebfb23857ee6f052e20d04c921d29eea95
ssdeep: 12288:arZgklHCd1yYNzKcu8/4+urnXjiMGQkpjU24qWC6zRAym4M+ZK6um:UZghke8k45rXjApA2pWjRAym4MqH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T163F4D076E58862E2CEAC7BB0E43A0D772FA5FBDB1974524E23DE7B552DE73020411812
sha3_384: bba1425e9f43f9162d98138619beba403cc1ff276db8b02302cb63e86e992bf40a239a662d8f28928e6fe7e1ead3a5a7
ep_bytes: ff250020400000000000000000000000
timestamp: 2082-10-30 21:33:31


Version Info:

Translation: 0x0000 0x04b0
Comments: SSH, Telnet and Rlogin client
CompanyName: Simon Tatham
FileDescription: SSH, Telnet and Rlogin client
FileVersion: 0.74.0.0
InternalName: friendfridia.exe
LegalCopyright: Copyright © 1997-2020 Simon Tatham.
LegalTrademarks: 
OriginalFilename: friendfridia.exe
ProductName: PuTTY suite
ProductVersion: 0.74.0.0
Assembly Version: 0.74.0.0

Trojan:MSIL/AgentTesla.JNC!MTB also known as:

LionicTrojan.Win32.Malicious.4!c
Elasticmalicious (high confidence)
DrWebTrojan.Inject4.20508
MicroWorld-eScanTrojan.GenericKD.38104498
FireEyeGeneric.mg.6b17243107b6f3c4
ALYacTrojan.GenericKD.38104498
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.3636360
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0057fe761 )
AlibabaTrojanDownloader:MSIL/Seraph.e8dfd79a
K7GWTrojan ( 0057fe761 )
Cybereasonmalicious.d987fe
BitDefenderThetaGen:NN.ZemsilF.34084.Vm0@a8P@f9l
CyrenW32/MSIL_Kryptik.EYK.gen!Eldorado
SymantecScr.Malcode!gdn41
ESET-NOD32a variant of MSIL/Kryptik.ACDD
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefenderTrojan.GenericKD.38104498
NANO-AntivirusTrojan.Win32.Seraph.jiloon
AvastWin32:MalwareX-gen [Trj]
TencentMsil.Trojan-downloader.Seraph.Wogd
Ad-AwareTrojan.GenericKD.38104498
EmsisoftTrojan.GenericKD.38104498 (B)
TrendMicroTROJ_GEN.R002C0PKO21
McAfee-GW-EditionPWS-FCXS!6B17243107B6
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataTrojan.GenericKD.38104498
eGambitUnsafe.AI_Score_100%
AviraHEUR/AGEN.1144147
ArcabitTrojan.Generic.D2456DB2
MicrosoftTrojan:MSIL/AgentTesla.JNC!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.AgentTesla.C4572492
McAfeePWS-FCXS!6B17243107B6
MAXmalware (ai score=100)
MalwarebytesMalware.AI.3210452211
TrendMicro-HouseCallTROJ_GEN.R002C0PKO21
IkarusTrojan-Spy.Agent
MaxSecureTrojan.Malware.74570710.susgen
FortinetMSIL/Kryptik.ACDD!tr
AVGWin32:MalwareX-gen [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_80% (W)

How to remove Trojan:MSIL/AgentTesla.JNC!MTB?

Trojan:MSIL/AgentTesla.JNC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment