About “Trojan:MSIL/DarkTortilla.O!MTB” infection

The Trojan:MSIL/DarkTortilla.O!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/DarkTortilla.O!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Trojan:MSIL/DarkTortilla.O!MTB?


File Info:
name: 4D434FA5B816D5BD40F1.mlw
path: /opt/CAPEv2/storage/binaries/6daa2c27868db35dc12d4623b390317524a4f45d54b81292e112bda4a10d2314
crc32: B9DFA23F
md5: 4d434fa5b816d5bd40f1239dbdbb1911
sha1: a4f441db9ac6d2992ab6925767eb2a102f4d8108
sha256: 6daa2c27868db35dc12d4623b390317524a4f45d54b81292e112bda4a10d2314
sha512: 6507b7fb0426aad6d8366018e40cc53994c4d78c2545d1ac472f2b064801f8c68a7a7d8948952c8ca340b18175c59fdaeb0064a6eb75e74a5c9c63bf01b2cfee
ssdeep: 12288:4TkJwIWRerAutdepM6sDNJ7kKnVZd9/eL9YT0fXUkZEc/7lu/JXVwgnj:4wmRe8m76sDNxd9MWTaXUrOOJXVw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E81523DEA3840F55D33C2738419B12C057B3A6E18E06F7299CC493EA5FF252AEA5147A
sha3_384: ebf10355f1ec81ab2aed30c12d8bd41a397333961d36c375fa3ea2a04d75a1f564f6df0cb2713f82e996869a1f7ec313
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-10-26 06:29:32

Version Info:
Translation: 0x0000 0x04b0
Comments: AppHelpêrCap
CompanyName: AppHelpêrCap
FileDescription: AppHelpêrCap
FileVersion: 2.3.4.5
InternalName: up3.exe
LegalCopyright: Copyright © 2023 78E6D2I;4@=8FEA4
OriginalFilename: up3.exe
ProductName: AppHelpêrCap
ProductVersion: 2.3.4.5
Assembly Version: 1.0.0.0

Trojan:MSIL/DarkTortilla.O!MTB also known as:

MicroWorld-eScan	Gen:Variant.MSILHeracles.120314
Skyhigh	BehavesLike.Win32.Generic.ch
McAfee	Artemis!4D434FA5B816
Malwarebytes	Malware.AI.4023287294
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005ad1ec1 )
BitDefender	Gen:Variant.MSILHeracles.120314
K7GW	Trojan ( 005ad1ec1 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AJYN
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:f+ISuzeQyvLDDnNSdo8oKw)
Sophos	ML/PE-A
F-Secure	Trojan.TR/AD.Xiclog.qqxhz
DrWeb	Trojan.PackedNET.2503
VIPRE	Gen:Variant.MSILHeracles.120314
TrendMicro	TROJ_GEN.R06CC0DJS23
FireEye	Generic.mg.4d434fa5b816d5bd
Emsisoft	Gen:Variant.MSILHeracles.120314 (B)
Ikarus	Trojan.MSIL.Crypt
Google	Detected
Avira	TR/AD.Xiclog.qqxhz
Microsoft	Trojan:MSIL/DarkTortilla.O!MTB
Arcabit	Trojan.MSILHeracles.D1D5FA
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Gen:Variant.MSILHeracles.120314
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.36792.3m0@a0npJng
ALYac	Gen:Variant.MSILHeracles.120314
MAX	malware (ai score=88)
DeepInstinct	MALICIOUS
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R06CC0DJS23
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	MSIL/Kryptik.AJYN!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.b9ac6d
Avast	Win32:PWSX-gen [Trj]

How to remove Trojan:MSIL/DarkTortilla.O!MTB?

Trojan:MSIL/DarkTortilla.O!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X