Trojan:MSIL/AgentTesla.KABR!MTB removal

The Trojan:MSIL/AgentTesla.KABR!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.KABR!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Trojan:MSIL/AgentTesla.KABR!MTB?


File Info:
name: FEDFD0718F0B177113F5.mlw
path: /opt/CAPEv2/storage/binaries/7efe64580bb20282d0566d237d35f4dbcb17b32802edc174295ed7114c7b5bf9
crc32: 355BDF11
md5: fedfd0718f0b177113f56ed8693502f9
sha1: f5a3f58eeca55c4d5f63831ac400ad13e58e216a
sha256: 7efe64580bb20282d0566d237d35f4dbcb17b32802edc174295ed7114c7b5bf9
sha512: 8acdc3dae975ef3df5eccb07efb9ae4d096b9e5133a0331b612a9531e9c61e653234071e849ca5ed2a119a9b5af44eac428d1accafddb1abc8dd69cf9cea5c4a
ssdeep: 6144:FeR+WirJC36P8cjmJGdZnNlr9jXjQAczVLoOStPj6zAofaQNQ1rSjeZg+h:0rRc7h
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15644A73C98BE262B60B4E692DBE58427F450946F715D6D35A8D3C396730AE4338C3A3D
sha3_384: 756157e6b0145c6d6c5c8a0cf94ac4c336f10ccc29f37e0bb430c2b6b2a844647617a2bfd4c1b68a101c9d87d4133459
ep_bytes: 
timestamp: 2101-08-14 15:26:48

Version Info:
0: [No Data]

Trojan:MSIL/AgentTesla.KABR!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 100)
FireEye	Trojan.GenericKDZ.104874
Skyhigh	BehavesLike.Win32.Generic.dz
Malwarebytes	Malware.AI.522378974
Sangfor	Trojan.Msil.Agent.Vpns
Alibaba	Trojan:MSIL/AgentTesla.d4918d98
Cybereason	malicious.eeca55
Arcabit	Trojan.Generic.D199AA
VirIT	Trojan.Win32.MSIL_Heur.A
BitDefender	Trojan.GenericKDZ.104874
MicroWorld-eScan	Trojan.GenericKDZ.104874
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:DkDlF7aA43ixkORBrr4R/w)
Emsisoft	Trojan.GenericKDZ.104874 (B)
VIPRE	Trojan.GenericKDZ.104874
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Antiy-AVL	GrayWare/MSIL.Kryptik.enu
Kingsoft	malware.kb.a.990
Xcitium	Heur.Corrupt.PE@1z141z3
Microsoft	Trojan:MSIL/AgentTesla.KABR!MTB
GData	Trojan.GenericKDZ.104874
Google	Detected
ALYac	Trojan.GenericKDZ.104874
MAX	malware (ai score=80)
SentinelOne	Static AI – Suspicious PE
Fortinet	MSIL/Kryptik.AKED!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Trojan:MSIL/AgentTesla.KABR!MTB?

Trojan:MSIL/AgentTesla.KABR!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X