About “Trojan:MSIL/AgentTesla.PTHA!MTB” infection

The Trojan:MSIL/AgentTesla.PTHA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.PTHA!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.PTHA!MTB?


File Info:
name: 412987D73D654757385F.mlw
path: /opt/CAPEv2/storage/binaries/1c331266b2844e5aec370289fdf98f47cdc090fc3dd0001b372d0eeb7c3ab8f5
crc32: 1659BC4E
md5: 412987d73d654757385f9058c2d5429d
sha1: f7fc2d181f7f66ceb1998822e6f18b5268236712
sha256: 1c331266b2844e5aec370289fdf98f47cdc090fc3dd0001b372d0eeb7c3ab8f5
sha512: b496e793dfcd47599d6d9b98e9149aa71a6a6a877c45e484813b64d3c2c175be2e52bccf95c8a53d2098ca7966e264d5fe955d3875ed6ac870e17de16f231737
ssdeep: 3072:ybnsMBPtDde0JJXVn0Lstgp59FzW9Xio1mB:ru/eopVnTgX9FzWFAB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T157F3C7145EA5C297D26EE7F241951589CFF84016EBCEFB86A8D230E855A6302FE0707F
sha3_384: 9b39a941422abbf9bb12e51a9c94fc8cd8ebda9193c87f634954ef501505270e37de89e3788a53fe0471a15f76be30ab
ep_bytes: 
timestamp: 2024-01-24 18:59:15

Version Info:
0: [No Data]

Trojan:MSIL/AgentTesla.PTHA!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.AgentTesla.4!c
Skyhigh	BehavesLike.Win32.Generic.cm
Alibaba	Trojan:MSIL/AgentTesla.d2705e97
Cynet	Malicious (score: 100)
Trapmine	malicious.moderate.ml.score
Ikarus	Trojan.MSIL.AgentTesla
Kingsoft	malware.kb.a.798
Microsoft	Trojan:MSIL/AgentTesla.PTHA!MTB
GData	Win32.Trojan.Agent.9X1J4Q
Google	Detected
TrendMicro-HouseCall	TROJ_GEN.R03BH01AT24
Rising	Trojan.Generic@AI.99 (RDML:0x7iPIkDg6OhVBb2tYqjSg)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.216104596.susgen
Fortinet	PossibleThreat.PALLAS.M
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_70% (W)

How to remove Trojan:MSIL/AgentTesla.PTHA!MTB?

Trojan:MSIL/AgentTesla.PTHA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X