Trojan:MSIL/AgentTesla!MTB removal guide

The Trojan:MSIL/AgentTesla!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:MSIL/AgentTesla!MTB virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Creates a hidden or system file
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:MSIL/AgentTesla!MTB?


File Info:
crc32: D1F189AD
md5: 70765fc4e4185e5fdce8212a0269b19f
name: napi.exe
sha1: 42ac045f3c43bfb363735b5d4032a1273609d36d
sha256: 4daffc0f198b2e6bb09791920c0a54044d577c0f4dae0df7e159a8d3784dc5a1
sha512: 0eaf4f660964387a7a65d9f63079c586f97f4bf7be5295e9e3af930f1b5199a9cb610fb8bd6e1930bd26543b585915731c25d92ea36f91317920c88fff207dec
ssdeep: 3072:gQHufT+ojiuX7tDAGIUuZQJFIyMZh/z1Tu:gm2jibGIUpJij6
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2019
Assembly Version: 1.0.0.0
InternalName: qOwxDK.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: WindowsFormsApp5
ProductVersion: 1.0.0.0
FileDescription: WindowsFormsApp5
OriginalFilename: qOwxDK.exe

Trojan:MSIL/AgentTesla!MTB also known as:

MicroWorld-eScan	Gen:Variant.MSILPerseus.210690
Qihoo-360	HEUR/QVM03.0.9267.Malware.Gen
McAfee	Artemis!70765FC4E418
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056106e1 )
BitDefender	Gen:Variant.MSILPerseus.210690
K7GW	Trojan ( 0056106e1 )
Cybereason	malicious.f3c43b
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.UTM
GData	Gen:Variant.MSILPerseus.210690
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
Avast	Win32:KeyloggerX-gen [Trj]
Ad-Aware	Gen:Variant.MSILPerseus.210690
Sophos	Mal/Kryptik-DL
F-Secure	Trojan.TR/RedCap.ampet
McAfee-GW-Edition	Artemis
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.70765fc4e4185e5f
Emsisoft	Gen:Variant.MSILPerseus.210690 (B)
APEX	Malicious
Avira	TR/RedCap.ampet
Endgame	malicious (high confidence)
Arcabit	Trojan.MSILPerseus.D33702
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
Microsoft	Trojan:MSIL/AgentTesla!MTB
ALYac	Gen:Variant.MSILPerseus.210690
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.VND
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Kryptik.UTM!tr
AVG	Win32:KeyloggerX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (D)

How to remove Trojan:MSIL/AgentTesla!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:MSIL/AgentTesla!MTB removal guide