What is “TrojanSpy:MSIL/AgentTesla!rfn”?

The TrojanSpy:MSIL/AgentTesla!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanSpy:MSIL/AgentTesla!rfn virus can do?

Injection (inter-process)
Reads data out of its own binary image
Uses Windows utilities for basic functionality

How to determine TrojanSpy:MSIL/AgentTesla!rfn?


File Info:
crc32: B9C51D32
md5: a9fa8e4e751d891fb1cab05d3c8c909a
name: upload_file
sha1: d35b8799303cd84a4e0bd6ddd27bff2677197ca7
sha256: f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf
sha512: b325fdada79f1d4c475ec9617f29d992a3e89f2dd39616b8efb228c3e79548223d27be6a492d2ec3220c5e0dd6eb0657e8160c0ac5e4753a8edbd2703255b9fb
ssdeep: 12288:1b/8fwVK6wfyE0S/9U8WY5uJ/nTg/PiIlGeLazFyGgLurd:1b/8wV1vrJ/n0/aIlG6CFpgLurd
type: # ISO 9660 CD-ROM filesystem data 'ARRIYADH NEW_PDF________________'

Version Info:
0: [No Data]

TrojanSpy:MSIL/AgentTesla!rfn also known as:

DrWeb	Trojan.PackedNET.402
FireEye	Trojan.GenericKDZ.69154
CAT-QuickHeal	Trojan.MSIL
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
TrendMicro	Mal_GENISO-4
BitDefenderTheta	Gen:NN.ZemsilF.34152.Jm0@amLqbSo
Cyren	W32/MSIL_Kryptik.BGQ.gen!Eldorado
Symantec	Trojan.Gen.2
TrendMicro-HouseCall	Mal_GENISO-4
Avast	Win32:MalwareX-gen [Trj]
GData	Trojan.GenericKDZ.69154
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKDZ.69154
Sophos	Mal/Generic-S
Invincea	heuristic
Emsisoft	Trojan.GenericKDZ.69154 (B)
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	TrojanSpy:MSIL/AgentTesla!rfn
Arcabit	Trojan.Generic.D10E22
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
McAfee	Fareit-FXO!006D990068BA
MAX	malware (ai score=89)
VBA32	TScope.Trojan.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.XDP
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan.MSIL.Inject
Fortinet	MSIL/Kryptik.XFP!tr
AVG	Win32:MalwareX-gen [Trj]
Qihoo-360	Generic/Trojan.21a

How to remove TrojanSpy:MSIL/AgentTesla!rfn?

TrojanSpy:MSIL/AgentTesla!rfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X