Trojan

About “Trojan:MSIL/AgentTesla.SRI!MTB” infection

Malware Removal

The Trojan:MSIL/AgentTesla.SRI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/AgentTesla.SRI!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/AgentTesla.SRI!MTB?



File Info:

name: 9BEFB7B747569E211828.mlw
path: /opt/CAPEv2/storage/binaries/700b1f3f85e455110c1c3cb85ca4c60597dd27b2677277f660bf77db01944bf9
crc32: 19E07B0F
md5: 9befb7b747569e21182808cd33ca7c29
sha1: 4b5ff95676dd3df7d53fa342882ea93d616cec13
sha256: 700b1f3f85e455110c1c3cb85ca4c60597dd27b2677277f660bf77db01944bf9
sha512: cc6a73165e8d43f19a1c063d469495f419fad97767ef358bb4317855f396ea52be417245998bc7ca3a42e5d49aa0c72bfd081051c674860972bf1484ee0a98e9
ssdeep: 12288:GwfZUj1wjvH1JIb8Hviy3YjrB50d4WYsJ:lUs1JIb8HEX0dbTJ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T136C4BF6AFA4BCE91D425553211BFB80003B23EDB5AE3D6063F58B3180B736A64F5A54F
sha3_384: 9bc233b53a64bf27f2393b73191fe532a266eb3f3412994bae0e6c56491579eccff46c35ff7c5a676de4639cff50ddc5
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-02-03 06:38:54


Version Info:

Translation: 0x0000 0x04b0
Comments: Motivate Desktop
CompanyName: YuAo
FileDescription: Motivate Desktop
FileVersion: 2.1.0.0
InternalName: EventBuild.exe
LegalCopyright: Copyright © YuAo 2012
LegalTrademarks: 
OriginalFilename: EventBuild.exe
ProductName: Motivate Desktop
ProductVersion: 2.1.0.0
Assembly Version: 2.1.0.0

Trojan:MSIL/AgentTesla.SRI!MTB also known as:

LionicTrojan.MSIL.Noon.l!c
DrWebTrojan.PackedNET.1183
MicroWorld-eScanTrojan.GenericKD.38871504
FireEyeTrojan.GenericKD.38871504
CAT-QuickHealTrojanSpy.MSIL
McAfeeRDN/Generic PWS.y
CylanceUnsafe
SangforTrojan.MSIL.Noon.gen
K7AntiVirusTrojan ( 0052eef11 )
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 0052eef11 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/MSIL_Agent.CRR.gen!Eldorado
SymantecScr.Malcode!gdn34
ESET-NOD32Win32/Formbook.AA
TrendMicro-HouseCallTROJ_GEN.R002C0DB622
Paloaltogeneric.ml
ClamAVWin.Dropper.Nanocore-9938512-0
BitDefenderTrojan.GenericKD.38871504
AvastWin32:PWSX-gen [Trj]
Ad-AwareTrojan.GenericKD.38871504
EmsisoftTrojan.Crypt (A)
ComodoMalware@#2c5t8ec7ca7ri
TrendMicroTROJ_GEN.R002C0DB622
McAfee-GW-EditionRDN/Generic PWS.y
SophosMal/Generic-S + Troj/Tesla-BJA
SentinelOneStatic AI – Suspicious PE
GDataTrojan.GenericKD.38871504
AviraTR/AD.Swotter.ssylk
Antiy-AVLTrojan/Generic.ASMalwS.3521F78
GridinsoftRansom.Win32.Sabsik.sa
ViRobotTrojan.Win32.Z.Outbreak.583168
MicrosoftTrojan:MSIL/AgentTesla.SRI!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.PWSX-gen.C4952527
VBA32TScope.Trojan.MSIL
ALYacTrojan.Agent.FormBook
MAXmalware (ai score=89)
MalwarebytesTrojan.MalPack.PNG.Generic
APEXMalicious
eGambitGeneric.Malware
FortinetMalicious_Behavior.SB
AVGWin32:PWSX-gen [Trj]
PandaTrj/GdSda.A
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan:MSIL/AgentTesla.SRI!MTB?

Trojan:MSIL/AgentTesla.SRI!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment