Trojan

What is “Trojan:MSIL/DCRat.MA!MTB”?

Malware Removal

The Trojan:MSIL/DCRat.MA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/DCRat.MA!MTB virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the DCRat malware family
  • Anomalous binary characteristics

How to determine Trojan:MSIL/DCRat.MA!MTB?



File Info:

name: 011ABC4C7F96F61BDCA1.mlw
path: /opt/CAPEv2/storage/binaries/ea37857787c7c70f7ed72ef34e3bec03a6b775ec7048411a811717230d943d86
crc32: 187410BE
md5: 011abc4c7f96f61bdca14fc60131c7ba
sha1: 75fa0ac651b1ee61798c695e98d813d2b6dc9b97
sha256: ea37857787c7c70f7ed72ef34e3bec03a6b775ec7048411a811717230d943d86
sha512: 0424fe051b24bead15b7c9a02fda6a908c6d9f0d49e9ab30b60d65c6d39f80fd6e49d04d7c13cd8dff97400a96bcadd93b5e3868f0ec23b043678a129ad455bf
ssdeep: 24576:hCNqlizzN4yGwrXLoamoWvXa7IwfvoMODACOfCt2lPy1A9QsD2lPy1A9QnU:AwgKyGwHthIwf7gOqt2wKQsD2wKQnU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1059575342EEA5019F1B3BF7C9AF435959A6FBEA37B27854D0061028A0733A41DDD173A
sha3_384: 416a9bfb26a6ce6b2599e977c83dad8640227014e0a75e80c9d37e607715668caa0938e9e09ee67da0948d70c7aa39b2
ep_bytes: ff250020d30000000000000000000000
timestamp: 2022-07-24 15:13:08


Version Info:

Build Id: Intouch2400MaintBuild_v0527
CompanyName: Schneider Electric Software, LLC.
Component Id: view_v0041
FileDescription: InTouch WindowViewer
FileVersion: 2400.0631.0527.0041
LegalCopyright: (c) 2015 Schneider Electric Software, LLC. All rights reserved.
LegalTrademarks: Schneider Electric, Wonderware and ArchestrA are trademarks of Schneider Electric SE, its subsidiaries and affiliated companies.
OriginalFilename: View.exe
ProductName: InTouch
ProductVersion: 11.1.13100
Translation: 0x0409 0x04b0

Trojan:MSIL/DCRat.MA!MTB also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.DCRat.4!c
MicroWorld-eScanIL:Trojan.MSILZilla.26381
ClamAVWin.Packed.Msilmamut-9987799-0
FireEyeGeneric.mg.011abc4c7f96f61b
ALYacIL:Trojan.MSILZilla.26381
MalwarebytesMalware.AI.2230680604
SangforTrojan.Win32.Save.a
AlibabaBackdoor:MSIL/DCRat.3ca50209
CrowdStrikewin/malicious_confidence_100% (W)
VirITTrojan.Win32.MSIL_Heur.A
CyrenW32/MSIL_Kryptik.JBT.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Spy.Agent.DTR
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyHEUR:Backdoor.MSIL.DCRat.gen
BitDefenderIL:Trojan.MSILZilla.26381
AvastWin32:DropperX-gen [Drp]
EmsisoftIL:Trojan.MSILZilla.26381 (B)
F-SecureHeuristic.HEUR/AGEN.1310064
DrWebBackDoor.DarkCrystalNET.18
VIPREIL:Trojan.MSILZilla.26381
TrendMicroTROJ_GEN.R002C0DD723
McAfee-GW-EditionBehavesLike.Win32.PWSZbot.tm
Trapminemalicious.high.ml.score
SophosTroj/DCRat-J
SentinelOneStatic AI – Malicious PE
GDataMSIL.Trojan.PSE.11DI5JD
JiangminBackdoor.MSIL.ftrw
AviraHEUR/AGEN.1310064
MAXmalware (ai score=84)
Antiy-AVLTrojan[Backdoor]/MSIL.DCRat
ArcabitIL:Trojan.MSILZilla.D670D
ViRobotTrojan.Win.Z.Dcrat.2043904.AA
ZoneAlarmHEUR:Backdoor.MSIL.DCRat.gen
MicrosoftTrojan:MSIL/DCRat.MA!MTB
GoogleDetected
AhnLab-V3Trojan/Win.MSILMamut.C5394515
McAfeeArtemis!011ABC4C7F96
TACHYONBackdoor/W32.DN-DCRat.2043904
VBA32Dropper.MSIL.gen
Cylanceunsafe
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R002C0DD723
RisingBackdoor.DCRat!1.E0D3 (CLASSIC)
IkarusTrojan.MSIL.Spy
MaxSecureTrojan.Malware.121218.susgen
FortinetMSIL/Agent.DTR!tr
AVGWin32:DropperX-gen [Drp]
DeepInstinctMALICIOUS

How to remove Trojan:MSIL/DCRat.MA!MTB?

Trojan:MSIL/DCRat.MA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment