Trojan:MSIL/AgentTesla.KABC!MTB removal instruction

The Trojan:MSIL/AgentTesla.KABC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.KABC!MTB virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.KABC!MTB?


File Info:
name: 91DBA632832725348774.mlw
path: /opt/CAPEv2/storage/binaries/640edcd4eb6616347387a6d6a22d7ff623e3702aaa40831fd128c3f9e1a4a414
crc32: E7FDB162
md5: 91dba632832725348774e1559d5a457e
sha1: bdaf538fd32cbd4860d468726dffb3ebb422139a
sha256: 640edcd4eb6616347387a6d6a22d7ff623e3702aaa40831fd128c3f9e1a4a414
sha512: 2a3a0f19254616ff3f02c953ee307cbe5ecf91b842845a4b7d41233c0d3112a254083cd768e66ce7abc2419ed2f9e8d9e692d4a3dc30d40dbde91f96312a2aa5
ssdeep: 24576:eEvuo1jfG6PduK+qFv/REuCQMHg/nS+INNTJaAWHUW3p:eA3bdD+qJRRyHoS/NNTJu0Gp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T121351290A2EE8B76FE3853F51129A6044BF77C2B7076E3495E9274C221B9F001B46F5B
sha3_384: 1eec4b4b81c436dc1d06ba9bbd1025199e4bca38354153e78125367beb9537d25e4018322b15f236051d4c14b29df561
ep_bytes: ff250020400000000000000000000000
timestamp: 2105-07-05 18:36:08

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft Corporation
FileDescription: Style Resource
FileVersion: 1.0.0.0
InternalName: dKBDlIS.exe
LegalCopyright: Copyright ©  2023
LegalTrademarks: 
OriginalFilename: dKBDlIS.exe
ProductName: Style Resource
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.KABC!MTB also known as:

Skyhigh	BehavesLike.Win32.Generic.tc
McAfee	Artemis!91DBA6328327
Malwarebytes	Malware.AI.2956455341
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.fd32cb
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GPSA
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:rrL9F7jUvFBFNIk8iUIMUA)
Sophos	Troj/Krypt-ABH
F-Secure	Trojan.TR/AD.Remcos.tfcie
DrWeb	Trojan.PackedNET.2510
FireEye	Generic.mg.91dba63283272534
Ikarus	Trojan-Ransom.Lokilocker
Google	Detected
Avira	TR/AD.Remcos.tfcie
Varist	W32/MSIL_Agent.FPI.gen!Eldorado
Microsoft	Trojan:MSIL/AgentTesla.KABC!MTB
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.36792.bn0@aGW5H3j
DeepInstinct	MALICIOUS
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.ATU!tr
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:MSIL/AgentTesla.KABC!MTB?

Trojan:MSIL/AgentTesla.KABC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X