Trojan:MSIL/AgentTesla.RPI!MTB (file analysis)

The Trojan:MSIL/AgentTesla.RPI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/AgentTesla.RPI!MTB virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Trojan:MSIL/AgentTesla.RPI!MTB?


File Info:
name: 590CFDB62D2011641F93.mlw
path: /opt/CAPEv2/storage/binaries/f712197f1720b6fd0d9d3ceb3d5570693fe537201c08bf941c0bd9a3c072563b
crc32: 7840FA83
md5: 590cfdb62d2011641f93481ee088f797
sha1: 7d49fb7cdb1a9901326d71debb940456f5f4b728
sha256: f712197f1720b6fd0d9d3ceb3d5570693fe537201c08bf941c0bd9a3c072563b
sha512: a4b2fc34608bd0f93d19038c1ad99e90f69dd33c133028920438eb349bf18c829e08072a9ab820cdad1939f5648492b6a10b5df507467b05f51944ff9521a87e
ssdeep: 3072:p9FQy/ckzc6jyhiGvAjIkwODHdAFE7ESdh3HATJggj8RzOPh+yvDRJUauxfwi7Ot:p9WeDWvTiAFEwSHvgOizpbhQQCGS
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T143441E6603172EB0EFCD20F58CF726CA1E446BDE13A9C060E6D758F65B72E79EA45024
sha3_384: 5685d63cc7c343f0edbee1ba7225b115e2b69e7a1126171c61be1901727eb125341bc8058352ae4ab3fc95dcf7ecd4d6
ep_bytes: ff250020001000000000000000000000
timestamp: 2019-04-10 23:59:23

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: usbeh_relkhxt.dll
LegalCopyright:  
OriginalFilename: usbeh_relkhxt.dll
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan:MSIL/AgentTesla.RPI!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.MSIL.Kryptik.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.388469
Skyhigh	BehavesLike.Win32.Generic.dm
McAfee	RDN/Generic.dx
Cylance	unsafe
Zillya	Trojan.Agent.Win32.2809025
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0058ea051 )
Alibaba	Trojan:MSIL/Kryptik.d1b1b3d0
K7GW	Trojan ( 0058ea051 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Barys.D5ED75
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Agent.VRS
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Agent-9967677-1
Kaspersky	HEUR:Trojan.MSIL.Kryptik.gen
BitDefender	Gen:Variant.Barys.388469
Avast	Win32:MalwareX-gen [Trj]
Emsisoft	Gen:Variant.Barys.388469 (B)
F-Secure	Heuristic.HEUR/AGEN.1301100
VIPRE	Gen:Variant.Barys.388469
TrendMicro	TrojanSpy.MSIL.NEGASTEAL.SMRJAHSPH
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Agent
Varist	W32/MSIL_Agent.CKH.gen!Eldorado
Avira	HEUR/AGEN.1301100
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:MSIL/AgentTesla.RPI!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Kryptik.gen
GData	Gen:Variant.Barys.388469
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5180650
Malwarebytes	Trojan.Crypt.MSIL.Generic
Panda	Trj/GdSda.A
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.VRS!tr
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:MSIL/AgentTesla.RPI!MTB?

Trojan:MSIL/AgentTesla.RPI!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X