Trojan

Trojan:MSIL/AgentTesla.NBL!MTB removal tips

Malware Removal

The Trojan:MSIL/AgentTesla.NBL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.NBL!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.NBL!MTB?



File Info:

name: D03673D946A0503BDED4.mlw
path: /opt/CAPEv2/storage/binaries/a612b4736bef50a4d1dccb200fa3f59c17cc51e5488f4dd6f6a5361b6b4cb2b5
crc32: 4EB5AC3D
md5: d03673d946a0503bded45e9d36fc2d9a
sha1: 1dcafe04faeee87a377178acc99979ed48fd83fc
sha256: a612b4736bef50a4d1dccb200fa3f59c17cc51e5488f4dd6f6a5361b6b4cb2b5
sha512: e9c8001392797de0e9a0439e58aba2d11dab6c365d159bf955ea4555350deac9d9f41997d86b25331e6a3b95301254016ac1bf13be293f54d497d66de629c101
ssdeep: 24576:JY1tVIJkUH0x1SwV9374SBfJtZ7ycdrHDQ:JYX2k0g/93HTZuIjD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A405E0CA21E9C5D6ECFADBF82DB2A0030EB5BDE095A1D14D2E4D314965B1FE8851CB31
sha3_384: f22df455a82b252ba3a0ef94b28a939d8a476fbcd7a8eeb7ac184631cc87dbe57f76882c56a10f253cedd30313353d7b
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-08 00:41:12


Version Info:

Translation: 0x0000 0x04b0
Comments: Documentation maker
CompanyName: Víctor Cruz
FileDescription: OrionDocs
FileVersion: 0.17.3.1
InternalName: mHjEx.exe
LegalCopyright: 2017
LegalTrademarks: OrionDocs
OriginalFilename: mHjEx.exe
ProductName: OrionDocs
ProductVersion: 0.17.3.1
Assembly Version: 0.17.3.1

Trojan:MSIL/AgentTesla.NBL!MTB also known as:

LionicTrojan.MSIL.Agensla.i!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.47864699
FireEyeGeneric.mg.d03673d946a0503b
CAT-QuickHealTrojan.IGENERIC
ALYacTrojan.GenericKD.47864699
CylanceUnsafe
SangforInfostealer.MSIL.Agensla.gen
K7AntiVirusTrojan ( 0058cc571 )
AlibabaTrojan:Win32/starter.ali1000139
K7GWTrojan ( 0058cc571 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/MSIL_Kryptik.GIP.gen!Eldorado
SymantecScr.Malcode!gdn30
ESET-NOD32a variant of MSIL/Kryptik.ADYX
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.47864699
AvastWin32:CrypterX-gen [Trj]
TencentMsil.Trojan-qqpass.Qqrob.Wnlu
Ad-AwareTrojan.GenericKD.47864699
SophosMal/Generic-S + Troj/Krypt-GA
ComodoMalware@#3u659o2oo6esy
DrWebTrojan.Hosts.49247
ZillyaTrojan.Kryptik.Win32.3672765
TrendMicroTROJ_FRS.0NA103AB22
McAfee-GW-EditionBehavesLike.Win32.Fareit.cc
EmsisoftTrojan.GenericKD.47864699 (B)
SentinelOneStatic AI – Malicious PE
GDataTrojan.GenericKD.47864699
JiangminTrojan.PSW.MSIL.ddbe
WebrootW32.Trojan.Gen
AviraTR/Kryptik.iyrii
Antiy-AVLTrojan/Generic.ASMalwS.3501719
KingsoftWin32.PSWTroj.Undef.(kcloud)
GridinsoftRansom.Win32.Sabsik.sa
ViRobotTrojan.Win32.Z.Agent.864768.AX
MicrosoftTrojan:MSIL/AgentTesla.NBL!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.AgentTesla.C4900043
McAfeeAgentTesla-FDGF!D03673D946A0
VBA32Malware-Cryptor.MSIL.AgentTesla.Heur
MalwarebytesMalware.AI.4103458260
TrendMicro-HouseCallTROJ_FRS.0NA103AB22
RisingMalware.Obfus/MSIL@AI.98 (RDM.MSIL:YPy0YRm9rWEVYhZHnMEAvA)
YandexTrojan.Kryptik!uEbx12/fB34
IkarusTrojan.MSIL.Inject
MaxSecureTrojan.Malware.74499699.susgen
FortinetMSIL/GenKryptik.FPNY!tr
AVGWin32:CrypterX-gen [Trj]
Cybereasonmalicious.946a05
PandaTrj/GdSda.A

How to remove Trojan:MSIL/AgentTesla.NBL!MTB?

Trojan:MSIL/AgentTesla.NBL!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment