Trojan:Win32/AgentTesla.AB!cert (file analysis)

The Trojan:Win32/AgentTesla.AB!cert is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/AgentTesla.AB!cert virus can do?

Executable code extraction
Presents an Authenticode digital signature
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan:Win32/AgentTesla.AB!cert?


File Info:
crc32: B97A9AF8
md5: 2f28fcfb4cb4181d4203481d34f2ee72
name: 2F28FCFB4CB4181D4203481D34F2EE72.mlw
sha1: df113aa7377e806bd9421c8f019ea0501e9cea8b
sha256: 73e23f31d4cd4f3090642971e804906ec87e08b7c6f545f4009500d3ca3cc6a2
sha512: 2d44416d8a76a3575610a4d629444bfc589461b702abdca380f9fbb834e7344c87a88329426ea2b04d122122e6cf8cda0b7f2695a63e1a356f456a1101dfb402
ssdeep: 1536:HAJJJJJJJGTfYJa3BulPdos80FMnjicaTmzAvjUfa:gJJJJJJJgo60FMjKmkD
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
ProductVersion: 1.00
InternalName: antelopian
FileVersion: 1.00
OriginalFilename: antelopian.exe
ProductName: jen

Trojan:Win32/AgentTesla.AB!cert also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35640493
FireEye	Generic.mg.2f28fcfb4cb4181d
Qihoo-360	Win32/Trojan.edb
ALYac	Trojan.GenericKD.35640493
Cylance	Unsafe
AegisLab	Trojan.Win32.Vebzenpak.4!c
Sangfor	Malware
BitDefender	Trojan.GenericKD.35640493
Cyren	W32/Trojan.NRVW-5657
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	Trojan.Win32.Vebzenpak.acmw
BitDefenderTheta	Gen:NN.ZevbaF.34670.em1@aa3UTrei
Ad-Aware	Trojan.GenericKD.35640493
Emsisoft	Trojan.GenericKD.35640493 (B)
F-Secure	Trojan.TR/Crypt.Agent.avyzq
DrWeb	Trojan.VbCrypt.1879
TrendMicro	Trojan.Win32.MALREP.THLOHBO
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S + Troj/VB-KVS
Ikarus	Trojan.Win32.Crypt
Webroot	W32.Trojan.Gen
Avira	TR/Crypt.Agent.avyzq
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/AgentTesla.AB!cert
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D21FD4AD
ZoneAlarm	Trojan.Win32.Vebzenpak.acmw
GData	Win32.Trojan-Downloader.GuLoader.B22SN1
Cynet	Malicious (score: 90)
McAfee	RDN/GuLoader
MAX	malware (ai score=82)
Malwarebytes	Trojan.GuLoader.VB
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HICB
TrendMicro-HouseCall	Trojan.Win32.MALREP.THLOHBO
Rising	Trojan.Kryptik!8.8 (TFE:5:y6pwa2ong8N)
Fortinet	W32/Kryptik.HICB!tr
AVG	FileRepMalware

How to remove Trojan:Win32/AgentTesla.AB!cert?

Trojan:Win32/AgentTesla.AB!cert removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X