About “Trojan:MSIL/Redline.ARE!MTB” infection

The Trojan:MSIL/Redline.ARE!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/Redline.ARE!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the RedLine malware family

How to determine Trojan:MSIL/Redline.ARE!MTB?


File Info:
name: 1BB14045662D9E1CD936.mlw
path: /opt/CAPEv2/storage/binaries/1e65d2230e0e2279946e7b43d89b1dd85ebc9340114bf35c4291acaf9cdc081e
crc32: FF3A35C2
md5: 1bb14045662d9e1cd936ca5431b20e92
sha1: 36c601d1a11188133c3e4c3bac83ce3090a55596
sha256: 1e65d2230e0e2279946e7b43d89b1dd85ebc9340114bf35c4291acaf9cdc081e
sha512: 8cb691f37471c081983f356000dc0f5bbc7dd25eeb644bb3a614ebffb14df40f7f2ac84c28c23779dd34b31a6a1ca2fd7c567dde909c5c7409bd5859845a98c0
ssdeep: 3072:/Y7mLZY7mLDY7mL1Y7HY7mLDY7mL9rhY7mLDY7mL1Y7gY7mL1Y7BrwY7mL1Y77YF:/pzl6zfzlpl/l6Gul3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18294E017775BE1E9C86B0B7078AE536833E3DE5C0E96431B294B721E3C7AA074B25970
sha3_384: 78fb74ea348404e5f22fb2159e2f3f461e8b21e2ee31b7a66c07e77cf984668fd37e8027d51f0f69d14ce17110a0899a
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-07-09 18:11:23

Version Info:
Translation: 0x0000 0x04b0
Comments: FiSSAyyShDHRcAj
CompanyName: rdlOuYsHtRkbBG
FileDescription: oiTDnahOrMaexne
FileVersion: 1.0.0.0
InternalName: Monsoons.exe
LegalCopyright: BGNKPYKGhNjgvm
LegalTrademarks: TosawGoCJouSHvB
OriginalFilename: Monsoons.exe
ProductName: UIiYmlnjUkFaAwPMqmU
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Redline.ARE!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Mardom.PN.19
FireEye	Generic.mg.1bb14045662d9e1c
ALYac	Gen:Trojan.Mardom.PN.19
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Trojan.Mardom.PN.19
CrowdStrike	win/malicious_confidence_90% (D)
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Agent.TZL
APEX	Malicious
ClamAV	Win.Malware.Msilkrypt-9839010-0
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
Rising	Trojan.Agent!1.D384 (CLASSIC)
Sophos	Troj/MSIL-PNC
DrWeb	Trojan.DownLoader36.36404
VIPRE	Gen:Trojan.Mardom.PN.19
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Trojan.Mardom.PN.19 (B)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=86)
Google	Detected
Varist	W32/MSIL_Agent.FID.gen!Eldorado
Antiy-AVL	Trojan/MSIL.Agent
Kingsoft	malware.kb.c.926
Microsoft	Trojan:MSIL/Redline.ARE!MTB
Arcabit	Trojan.Mardom.PN.19
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
GData	MSIL.Trojan.Agent.AXW
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R363865
DeepInstinct	MALICIOUS
VBA32	Trojan.MSIL.Krypt
Tencent	Trojan.Win32.Agent.zd
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.TZL!tr
BitDefenderTheta	Gen:NN.ZemsilF.36792.A00@aaGHEVb
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.1a1118
Avast	Win32:MalwareX-gen [Trj]

How to remove Trojan:MSIL/Redline.ARE!MTB?

Trojan:MSIL/Redline.ARE!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X