Trojan

Trojan:MSIL/Remcos!MTB (file analysis)

Malware Removal

The Trojan:MSIL/Remcos!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/Remcos!MTB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/Remcos!MTB?



File Info:

name: F5C34502DC6BFA6A3422.mlw
path: /opt/CAPEv2/storage/binaries/e1eb708f47303b831f6eb0ddc846e21782e8f727dcb0088fcb997c3bf0d4dbd3
crc32: EEBB1EB6
md5: f5c34502dc6bfa6a3422017f506d333c
sha1: bcc954d5ce331788078014e4228d45708b241260
sha256: e1eb708f47303b831f6eb0ddc846e21782e8f727dcb0088fcb997c3bf0d4dbd3
sha512: 9389372ec49798b38876d5655ba51c23c5896e134c727181f1678ab922c7a668f61fe6f54dfc79356475b4061c96e2b5b24c9404892384145009183ff0d8f5a4
ssdeep: 24576:04444+yWQDTaaZdVbID9YNKIbTPO2MADn87SumJEVK87v4/yWjslSey4444:Dy5sAKiTPtn87jSLy4sY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12D2512FEBB68CE37D96D587DD412198282B72D51EA02DF9E7DE032EC6C773920102196
sha3_384: af57abd063906866fdb629c95fa4421209b1c90477357d92fafbf47b2ce8e7f15fbddadb8f7fc7a1367f5bbca46fb3dd
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-07 11:51:49


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Ziyi
FileVersion: 1.0.0.0
InternalName: uEuC.exe
LegalCopyright: Copyright ©  2011
LegalTrademarks: 
OriginalFilename: uEuC.exe
ProductName: Ziyi
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Remcos!MTB also known as:

LionicTrojan.MSIL.Remcos.m!c
tehtrisGeneric.Malware
DrWebTrojan.Inject4.42180
MicroWorld-eScanGen:Variant.Marsilia.10180
FireEyeGeneric.mg.f5c34502dc6bfa6a
McAfeeRDN/Real Protect-LS
Cylanceunsafe
ZillyaTrojan.GenKryptik.Win32.153886
SangforBackdoor.Msil.Remcos.Va8g
K7AntiVirusTrojan ( 00599a371 )
AlibabaTrojan:Win32/Kryptik.ali2000016
K7GWTrojan ( 00599a371 )
Cybereasonmalicious.5ce331
VirITTrojan.Win32.MSIL_Heur.B
CyrenW32/MSIL_Kryptik.DWR.gen!Eldorado
SymantecTrojan Horse
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/GenKryptik.FZTU
AvastWin32:RATX-gen [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Backdoor.MSIL.Remcos.gen
BitDefenderGen:Variant.Marsilia.10180
NANO-AntivirusTrojan.Win32.Remcos.jsgzrt
TencentMalware.Win32.Gencirc.13b9f685
SophosMal/Generic-S
F-SecureHeuristic.HEUR/AGEN.1323752
VIPREGen:Variant.Marsilia.10180
McAfee-GW-EditionBehavesLike.Win32.Generic.fc
Trapminemalicious.high.ml.score
EmsisoftGen:Variant.Marsilia.10180 (B)
GDataGen:Variant.Marsilia.10180
JiangminBackdoor.MSIL.fxzc
WebrootW32.Trojan.Remcos
AviraHEUR/AGEN.1323752
Antiy-AVLTrojan/MSIL.GenKryptik
ArcabitTrojan.Marsilia.D27C4
ZoneAlarmHEUR:Backdoor.MSIL.Remcos.gen
MicrosoftTrojan:MSIL/Remcos!MTB
GoogleDetected
AhnLab-V3Trojan/Win.RunPE.C5233183
VBA32TScope.Trojan.MSIL
MAXmalware (ai score=100)
MalwarebytesTrojan.MalPack.PNG.Generic
PandaTrj/Chgt.AD
APEXMalicious
RisingBackdoor.Remcos!8.B89E (CLOUD)
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.73696032.susgen
FortinetMSIL/GenKryptik.FZTU!tr
AVGWin32:RATX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/Remcos!MTB?

Trojan:MSIL/Remcos!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment