Spy • Trojan

TrojanSpy:MSIL/AgentTesla.R!MTB removal guide

Malware Removal

The TrojanSpy:MSIL/AgentTesla.R!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What TrojanSpy:MSIL/AgentTesla.R!MTB virus can do?

  • Presents an Authenticode digital signature
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine TrojanSpy:MSIL/AgentTesla.R!MTB?



File Info:

crc32: 9AA9D47A
md5: 13385e551c73b3e85f227ded0a8b5bf7
name: 13385E551C73B3E85F227DED0A8B5BF7.mlw
sha1: 191896a4b9b0ab04affb0a99817d5a840f91f71a
sha256: 4d7785dcd99beca572613788bc8b0713ddda6da0c8df321b1402bc38e6880f88
sha512: 6c82458631b3852ec8ffc8a33efa28ec5f7690f6bf5fa7f09fca0ce6427e60c71e5949cb7f516e1d2b434ba37caa9838e3fac1ec96a4d9a45263734421a82b2e
ssdeep: 384:Vhi9COxO7C6gFWWax1dpXp/qo5p91ewfmzuZGmpALBFBCpCheQp:P6Fb6+WWax1dpXpxp9lpAdLheW
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows


Version Info:

LegalCopyright: Copyright 2022 xa9 YdtZoSxD. All rights reserved.
Assembly Version: 1.2.3.1
InternalName: PhYLxcEV.exe
FileVersion: 8.1.6.6
CompanyName: HAEbhExE
LegalTrademarks: XUfopSkl
Comments: ClpsFnjb
ProductName: PhYLxcEV
ProductVersion: 1.2.3.1
FileDescription: YBAIuSrK
OriginalFilename: PhYLxcEV.exe
Translation: 0x0409 0x0514

TrojanSpy:MSIL/AgentTesla.R!MTB also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.MSILHeracles.13795
FireEyeGen:Variant.MSILHeracles.13795
McAfeeRDN/Formbook
CylanceUnsafe
AegisLabTrojan.MSIL.Noon.l!c
SangforTrojan.DOC.Obfuse.TB!MTB
K7AntiVirusTrojan ( 005784391 )
BitDefenderGen:Variant.MSILHeracles.13795
BitDefenderThetaGen:NN.ZemsilCO.34590.bm1@aWIYnYii
CyrenW32/MSIL_Kryptik.DGL.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:DangerousSig [Trj]
KasperskyHEUR:Trojan-Spy.MSIL.Noon.gen
AlibabaTrojanSpy:MSIL/AgentTesla.a45afd84
Ad-AwareGen:Variant.MSILHeracles.13795
EmsisoftGen:Variant.MSILHeracles.13795 (B)
F-SecureTrojan.TR/Dldr.Agent.ojmiy
DrWebTrojan.Siggen12.3176
TrendMicroTrojanSpy.MSIL.NOON.THBBCBA
McAfee-GW-EditionArtemis!Trojan
SophosMal/Generic-S
AviraTR/Dldr.Agent.ojmiy
KingsoftWin32.Heur.KVM019.a.(kcloud)
MicrosoftTrojanSpy:MSIL/AgentTesla.R!MTB
ArcabitTrojan.Bulz.D5A08F
ZoneAlarmHEUR:Trojan-Spy.MSIL.Noon.gen
GDataGen:Variant.MSILHeracles.13795
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.C4345149
ALYacGen:Variant.Bulz.368783
MAXmalware (ai score=83)
MalwarebytesTrojan.FakeSig.Generic
PandaTrj/CI.A
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.HLE
TrendMicro-HouseCallTrojanSpy.MSIL.NOON.THBBCBA
RisingDownloader.Agent!1.D296 (CLOUD)
IkarusTrojan.MSIL.Crypt
FortinetMSIL/Kryptik.ZTE!tr
AVGWin32:DangerousSig [Trj]
Paloaltogeneric.ml
Qihoo-360Win32/TrojanSpy.Noon.HgIASPkA

How to remove TrojanSpy:MSIL/AgentTesla.R!MTB?

TrojanSpy:MSIL/AgentTesla.R!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment