Trojan

Trojan:MSIL/FormBook.ACA!MTB removal tips

Malware Removal

The Trojan:MSIL/FormBook.ACA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/FormBook.ACA!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics

How to determine Trojan:MSIL/FormBook.ACA!MTB?



File Info:

name: E947A53D435433367F43.mlw
path: /opt/CAPEv2/storage/binaries/ea2195dca33e4ef3cb13479111c1514794deaf79f640ef1051b251c79e43f29f
crc32: 4A490954
md5: e947a53d435433367f43e4cba87aa6e0
sha1: 8a418908a057c437ba912c74e20ce60bd7d11af0
sha256: ea2195dca33e4ef3cb13479111c1514794deaf79f640ef1051b251c79e43f29f
sha512: b84d31d67bc3e987e4306cf70ca735dd5f77b1f8d0b8c2f2895897e0fe2e4865e6ccff6ab13d85e6dac6374fbd8081224a3e99483945c26d85c6b3047f021c28
ssdeep: 12288:9W1BO5ZZC/W2n9jjZjXjpAQs8v/rLxeJUv+M9eY/DL7BC9d19DDUlcu97uIHIZf4:Y1qTC/f5VjpU83X469C9dLDtul
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B3E401ADA3B9D6B7C2990FBD402661883B7454E37637CA39EF8B008DFA577041D84687
sha3_384: 69faa1abf50a9f42aeca5995d9ca09011a97c95900e1b09af4286fa924106c30f111b2c213dcb43e8924ec6f9a667a45
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-04-19 05:20:26


Version Info:

Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: PGoy.exe
LegalCopyright:  
OriginalFilename: PGoy.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Trojan:MSIL/FormBook.ACA!MTB also known as:

LionicTrojan.Win32.Agensla.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.66502865
FireEyeGeneric.mg.e947a53d43543336
McAfeeArtemis!E947A53D4354
MalwarebytesInjector.Trojan.MSIL.DDS
VIPRETrojan.GenericKD.66502865
SangforInfostealer.Msil.AgentTesla.Veq4
K7AntiVirusTrojan ( 005a3d621 )
AlibabaTrojanPSW:MSIL/Agensla.882c68d5
K7GWTrojan ( 005a3d621 )
VirITTrojan.Win32.PSWStealer.DQL
CyrenW32/MSIL_Agent.FDS.gen!Eldorado
SymantecScr.Malcode!gdn34
ESET-NOD32a variant of MSIL/Injector.WFX
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderTrojan.GenericKD.66502865
AvastWin32:PWSX-gen [Trj]
TencentMsil.Trojan-QQPass.QQRob.Bwnw
SophosTroj/Krypt-XE
F-SecureTrojan.TR/Injector.qcyqy
DrWebTrojan.PackedNET.1965
TrendMicroTROJ_GEN.R03BC0PDP23
McAfee-GW-EditionBehavesLike.Win32.Generic.jc
Trapminesuspicious.low.ml.score
EmsisoftTrojan.GenericKD.66502865 (B)
SentinelOneStatic AI – Suspicious PE
GDataTrojan.GenericKD.66502865
AviraTR/Injector.qcyqy
Antiy-AVLTrojan/MSIL.Injector
ArcabitTrojan.Generic.D3F6C0D1
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
MicrosoftTrojan:MSIL/FormBook.ACA!MTB
GoogleDetected
AhnLab-V3Trojan/Win.Injection.C5415258
Acronissuspicious
BitDefenderThetaGen:NN.ZemsilF.36196.Rm0@amSLrFn
ALYacTrojan.GenericKD.66502865
MAXmalware (ai score=88)
Cylanceunsafe
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.R03BC0PDP23
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:kCf5RGZdcrOoEBQle3nVjg)
YandexTrojan.Igent.bZ4jkF.5
IkarusTrojan.MSIL.Inject
MaxSecureTrojan.Malware.74499699.susgen
FortinetMSIL/Kryptik.AIRP!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/FormBook.ACA!MTB?

Trojan:MSIL/FormBook.ACA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment