TrojanSpy:MSIL/PStealer.SL!MTB removal instruction

The TrojanSpy:MSIL/PStealer.SL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanSpy:MSIL/PStealer.SL!MTB virus can do?

Authenticode signature is invalid
Binary file triggered YARA rule
Binary compilation timestomping detected

How to determine TrojanSpy:MSIL/PStealer.SL!MTB?


File Info:
name: CE304037208BEC4E54ED.mlw
path: /opt/CAPEv2/storage/binaries/2671ac3f9b3e5b43cf0b237b41f3e7f3a3866e8e7508f13565eeef48fab1da5c
crc32: C2E45474
md5: ce304037208bec4e54edf63f3a609c8e
sha1: 57aaed879573f62208371d551af6065fe3b5a238
sha256: 2671ac3f9b3e5b43cf0b237b41f3e7f3a3866e8e7508f13565eeef48fab1da5c
sha512: e4a264d07e50b4d5437400c965b17731dfa7385c8488e4a3d77c88fbc6cab1127024c1c88b9eb7180a5c8ff2235acbcae74fe0854f97c798a6e63efb0773c9e0
ssdeep: 96:nix9V+J3ASAyczsx5ErLRA6P1VOMEzX1VTBhqS/iv5q4ywXKuuwZtO5F4EzNt:nqV+J3zizsPE/9YxISYbFKfEK2u
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16A121A04E7EC8226D9BF4B705CB3674143B9F395BC62DB6E14CC252F1912F448962BA2
sha3_384: 4bd7c7343dc37d6a121065321e37b991f3a2bd89d8b41901db2f32014bf86a00d69ff75c1e67b05b610cb99bad4d7587
ep_bytes: ff250020400000000000000000000000
timestamp: 2066-11-21 15:53:39

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: setup
FileVersion: 1.0.0.0
InternalName: setup.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: 
OriginalFilename: setup.exe
ProductName: setup
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

TrojanSpy:MSIL/PStealer.SL!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Tedy.297764
FireEye	Gen:Variant.Tedy.297764
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	Artemis!Trojan
McAfee	Artemis!CE304037208B
Cylance	unsafe
Sangfor	Infostealer.Msil.Agent.Vcau
K7AntiVirus	Password-Stealer ( 005a19031 )
Alibaba	TrojanPSW:MSIL/Stealer.1cb7fffc
K7GW	Password-Stealer ( 005a19031 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	MSIL.Downloader!gen7
ESET-NOD32	MSIL/PSW.Agent.SXV
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Variant.Tedy.297764
NANO-Antivirus	Trojan.Win32.Stealer.jvatuy
Avast	Win32:Trojan-gen
Tencent	Malware.Win32.Gencirc.13b5c8bd
Emsisoft	Gen:Variant.Tedy.297764 (B)
DrWeb	Trojan.PWS.Stealer.35640
Zillya	Trojan.Agent.Win32.3262878
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Google	Detected
Varist	W32/ABRisk.KGGH-0964
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	TrojanSpy:MSIL/PStealer.SL!MTB
Xcitium	Malware@#2hfzi21d957v6
Arcabit	Trojan.Tedy.D48B24
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
GData	Gen:Variant.Tedy.297764
BitDefenderTheta	Gen:NN.ZemsilF.36802.am0@amWSbFp
ALYac	Gen:Variant.Tedy.297764
MAX	malware (ai score=81)
Malwarebytes	Spyware.PasswordStealer.MSIL
Panda	Trj/Chgt.AD
Rising	Stealer.Agent!8.C2 (CLOUD)
Ikarus	Trojan.MSIL.PSW
MaxSecure	Trojan.Malware.74396735.susgen
Fortinet	MSIL/Agent.SIX!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.7208be
DeepInstinct	MALICIOUS

How to remove TrojanSpy:MSIL/PStealer.SL!MTB?

TrojanSpy:MSIL/PStealer.SL!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X