Trojan

About “Trojan:MSIL/Formbook.AMMB!MTB” infection

Malware Removal

The Trojan:MSIL/Formbook.AMMB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/Formbook.AMMB!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Trojan:MSIL/Formbook.AMMB!MTB?



File Info:

name: 4FCF2615E174B05EB6BC.mlw
path: /opt/CAPEv2/storage/binaries/9f841fb4ed2394c3df1f710c235666d94edbeb7784d532ef15bd8733978b0ba9
crc32: 3301F1F8
md5: 4fcf2615e174b05eb6bc4e7344df2220
sha1: 6884e6f88d64cf3792092b94bfb02ee2f6f71eba
sha256: 9f841fb4ed2394c3df1f710c235666d94edbeb7784d532ef15bd8733978b0ba9
sha512: 21669a3374df944aa54c69ed6fe0db304fee8c4162e840e7c395e140233347b6023338fdf54d91bf324b732d6602ab26e766d594c7496015e19fba015801d826
ssdeep: 24576:p+AQ32HYXjHSIyFVe7iokzfP9FJ2Oltw:p+h24XjyveGoIPbJF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1251502967A60C95AD0695B724C4392A1A369CFA07E37C90FF82F333EDB31BC46E51521
sha3_384: da624704c7b5ffd81610fca5eb1991ef0728ef3ccbf3f5bc144e44c9306677d0632404fbabbd70fb24b381666d78183c
ep_bytes: ff250020400000000000000000000000
timestamp: 2099-12-03 14:23:44


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: HeRoSorter
FileVersion: 1.0.0.0
InternalName: uUil.exe
LegalCopyright: Copyright ©  2021
LegalTrademarks: 
OriginalFilename: uUil.exe
ProductName: HeRoSorter
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Formbook.AMMB!MTB also known as:

BkavW32.AIDetectMalware.CS
DrWebBackDoor.AgentTeslaNET.6
MicroWorld-eScanIL:Trojan.MSILZilla.109531
FireEyeIL:Trojan.MSILZilla.109531
SkyhighBehavesLike.Win32.Generic.cc
McAfeeArtemis!4FCF2615E174
Cylanceunsafe
VIPREIL:Trojan.MSILZilla.109531
SangforInfostealer.Msil.AgentTesla.Vyp8
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:MSIL/Formbook.328e09d8
K7GWSpyware ( 005ac9ac1 )
K7AntiVirusSpyware ( 005ac9ac1 )
VirITTrojan.Win32.MSIL_Heur.A
SymantecScr.Malcode!gdn33
Elasticmalicious (high confidence)
ESET-NOD32MSIL/Spy.AgentTesla.I
APEXMalicious
TrendMicro-HouseCallTrojanSpy.Win32.NEGASTEAL.YXECNZ
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefenderIL:Trojan.MSILZilla.109531
NANO-AntivirusTrojan.Win32.AgentTeslaNET.kkoodm
AvastWin32:PWSX-gen [Trj]
TencentMalware.Win32.Gencirc.14055265
EmsisoftIL:Trojan.MSILZilla.109531 (B)
F-SecureTrojan.TR/AD.GenSteal.psvgo
ZillyaTrojan.AgentTesla.Win32.9102
TrendMicroTrojanSpy.Win32.NEGASTEAL.YXECNZ
Trapminemalicious.moderate.ml.score
SophosTroj/Krypt-ABH
IkarusTrojan.MSIL.Inject
GoogleDetected
AviraTR/AD.GenSteal.psvgo
VaristW32/MSIL_Agent.HTA.gen!Eldorado
MicrosoftTrojan:MSIL/Formbook.AMMB!MTB
ArcabitIL:Trojan.MSILZilla.D1ABDB
ViRobotTrojan.Win.Z.Agent.900608.G
ZoneAlarmHEUR:Trojan-PSW.MSIL.Agensla.gen
GDataIL:Trojan.MSILZilla.109531
AhnLab-V3Trojan/Win.FormBook.C5599684
VBA32TrojanLoader.MSIL.DaVinci.Heur
ALYacIL:Trojan.MSILZilla.109531
MAXmalware (ai score=88)
MalwarebytesTrojan.MalPack.PNG.Generic
PandaTrj/GdSda.A
RisingMalware.Obfus/MSIL@AI.91 (RDM.MSIL2:9V0JIAiWMKDCWFMkEywH2Q)
YandexTrojan.Igent.b1TVjK.21
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.74499699.susgen
FortinetMSIL/Stealer.36680!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
alibabacloudTrojan[stealer]:MSIL/AgentTesla.I

How to remove Trojan:MSIL/Formbook.AMMB!MTB?

Trojan:MSIL/Formbook.AMMB!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment