Categories: Trojan

How to remove “Trojan:MSIL/AgentTesla.NDI!MTB”?

The Trojan:MSIL/AgentTesla.NDI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:MSIL/AgentTesla.NDI!MTB virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Kashmiri
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Trojan:MSIL/AgentTesla.NDI!MTB?


File Info:
name: BDFDD483CED0CD36E079.mlwpath: /opt/CAPEv2/storage/binaries/800f0b3cb78a8f0934c09d710a8e42286275cbaa10dbdb1841669f6280f0ab51crc32: 88F7AC1Dmd5: bdfdd483ced0cd36e079b790bf2f3e9esha1: 0a7b0e52e7558f3c5555aec5e7aeebd6351c548dsha256: 800f0b3cb78a8f0934c09d710a8e42286275cbaa10dbdb1841669f6280f0ab51sha512: a2344cf70262f279101536c705a7a793252b88ed2d7eec62f92df06407efb0f95025957e72d388f2bc0b584df18de012ff480570f0ac84bce794bfbd47234ef1ssdeep: 6144:LfV2DiWRaQy77zLxKP6ib7U+W1QBhINBZJ4IbG2ANtbsQYrvk9:IDiWpM7xy9XUT1cSJYXatype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10064BF367705C7F3C7AA19329C060994EDE49C09DA5D8A426EE33BDC6AB3AD7493C0D4sha3_384: acb07ba86b8a290adf1a6c63afa4285f84c07eb0fb9737d1a67179662c1cbe8f86303570301682a01e6c017875ff0643ep_bytes: ff250020400000000000000000000000timestamp: 2022-01-17 09:19:36
Version Info:
CompanyName: HHD Software Ltd.FileDescription: Device Monitoring Studio Setup PackageFileVersion: 6.23.0.3373LegalCopyright: © 2011 by HHD Software Ltd.  All rights reserved.InternalName: setup.exeOriginalFilename: setup.exeProductName: Device Monitoring StudioProductVersion: 6.23.00.3373Translation: 0x0409 0x04e4

Trojan:MSIL/AgentTesla.NDI!MTB also known as:

Lionic	Trojan.MSIL.Certutil.3!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.15323
FireEye	Generic.mg.bdfdd483ced0cd36
McAfee	GenericRXRN-UW!BDFDD483CED0
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0058ace11 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 0058ace11 )
Cybereason	malicious.3ced0c
Cyren	W32/MSIL_Injector.YJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ADNP
APEX	Malicious
Paloalto	generic.ml
BitDefender	IL:Trojan.MSILZilla.15323
Avast	Win32:MalwareX-gen [Trj]
Tencent	Msil.Exploit.Certutil.Plaz
Ad-Aware	IL:Trojan.MSILZilla.15323
Comodo	Malware@#31cocgiwgp54w
DrWeb	Trojan.Siggen16.34806
Zillya	Trojan.Kryptik.Win32.3673076
TrendMicro	TrojanSpy.MSIL.KRYPTIK.ERSUSB822
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Trapmine	suspicious.low.ml.score
Emsisoft	IL:Trojan.MSILZilla.15323 (B)
Ikarus	Trojan.MSIL.Crypt
GData	IL:Trojan.MSILZilla.15323
Jiangmin	Exploit.MSIL.acz
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Kryptik.nbxlc
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.350CBC4
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Ransom.Win32.Bladabindi.sa
ViRobot	Trojan.Win32.Z.Kryptik.321024.CM
Microsoft	Trojan:MSIL/AgentTesla.NDI!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.RedLine.C4920137
BitDefenderTheta	Gen:NN.ZemsilF.34232.tm0@a0rTHzdG
ALYac	IL:Trojan.MSILZilla.15323
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack.MSIL
TrendMicro-HouseCall	TrojanSpy.MSIL.KRYPTIK.ERSUSB822
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:XXCWlPXsreIgLnVHG+/cXQ)
Yandex	Trojan.Kryptik!Vs72VTN2R4s
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Kryptik.ADNP!tr
Webroot	W32.Malware.Gen
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)