Trojan

Trojan:MSIL/AgentTesla.LPE!MTB removal tips

Malware Removal

The Trojan:MSIL/AgentTesla.LPE!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.LPE!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Network activity detected but not expressed in API logs
  • Binary compilation timestomping detected

Related domains:

wpad.local-net

How to determine Trojan:MSIL/AgentTesla.LPE!MTB?



File Info:

name: C47CCAA7EC048676DFB5.mlw
path: /opt/CAPEv2/storage/binaries/0ddb02a865ab2e19255ecfc994a87bc9564575996aedf3cfce9b27ac243b2a11
crc32: BE4FD222
md5: c47ccaa7ec048676dfb5904cf0210835
sha1: b0dccdbdc74185f839fe88b4a3678233908c1159
sha256: 0ddb02a865ab2e19255ecfc994a87bc9564575996aedf3cfce9b27ac243b2a11
sha512: af390f704bcf3e114c0a7521b6e6893488970dae81a2b0dccd53d34b1c052fa5142f456b0d1b84fef8c298af903448b158a7f365aa0ee48656a23bf9bea33a54
ssdeep: 6144:FJsy5aZclqWF281mDRdrcJLdL0tnd4CaXgtuBsZSFtKe20Q7baYU9+BGQt:LaSE81mNdrbtd2uuySeP0PWF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19DA4D00424D5E6A4F87FEBB51CB079C50778FDE5E944E2DEFC88719A9AB2B804E00572
sha3_384: 47e09c6ec32912101dd0408b6399614a65e57084aab930a8648e651d9caa96734bfe6f5c5d60a0adb5f9a2e93d3d7bb5
ep_bytes: ff250020400000000000000000000000
timestamp: 2058-11-26 05:53:45


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: RETRO Plugin
FileVersion: 1.0.0.0
InternalName: debevP.exe
LegalCopyright: Copyright © 2021 Marko Paakkunainen
LegalTrademarks: 
OriginalFilename: debevP.exe
ProductName: RETRO Plugin
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/AgentTesla.LPE!MTB also known as:

LionicTrojan.MSIL.Agensla.i!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.38098164
McAfeeAgentTesla-FDBQ!C47CCAA7EC04
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0058acea1 )
AlibabaTrojanPSW:MSIL/AgentTesla.ab6b2747
K7GWTrojan ( 0058acea1 )
CyrenW32/MSIL_Kryptik.GDP.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.ADOO
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.38098164
AvastWin32:CrypterX-gen [Trj]
Ad-AwareTrojan.GenericKD.38098164
SophosMal/Generic-R + Troj/Krypt-EZ
Comodofls.noname@0
DrWebBackDoor.SpyBotNET.25
TrendMicroTROJ_GEN.R002C0DKQ21
McAfee-GW-EditionAgentTesla-FDBQ!C47CCAA7EC04
FireEyeGeneric.mg.c47ccaa7ec048676
EmsisoftTrojan.GenericKD.38098164 (B)
SentinelOneStatic AI – Malicious PE
GDataTrojan.GenericKD.38098164
JiangminTrojan.PSW.MSIL.cxhi
WebrootW32.Trojan.Agenttesla
AviraTR/Kryptik.jubfl
Antiy-AVLTrojan/Generic.ASMalwS.34D7C0C
KingsoftWin32.PSWTroj.Undef.(kcloud)
ArcabitTrojan.Generic.D24554F4
ViRobotTrojan.Win32.Z.Kryptik.478208.U
MicrosoftTrojan:MSIL/AgentTesla.LPE!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.AgentTesla.R452542
VBA32Malware-Cryptor.MSIL.AgentTesla.Heur
ALYacTrojan.GenericKD.38098164
MAXmalware (ai score=100)
MalwarebytesTrojan.MalPack.PNG.Generic
TrendMicro-HouseCallTROJ_GEN.R002C0DKQ21
IkarusTrojan.Inject
FortinetMSIL/GenKryptik.FOCQ!tr
AVGWin32:CrypterX-gen [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan:MSIL/AgentTesla.LPE!MTB?

Trojan:MSIL/AgentTesla.LPE!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment