Trojan:Win32/AutoitShellInj.A!MTB information

The Trojan:Win32/AutoitShellInj.A!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/AutoitShellInj.A!MTB virus can do?

Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/AutoitShellInj.A!MTB?


File Info:
name: AB7AB26B932F65297899.mlw
path: /opt/CAPEv2/storage/binaries/9b51d7ae2cabe62158e5feca5eef3ec76113f5c20f49561a48bb73bf03964d7f
crc32: 551C4DDA
md5: ab7ab26b932f6529789927c5bf388bab
sha1: 326e735e59bd0936b5300c1249598c4ef1801325
sha256: 9b51d7ae2cabe62158e5feca5eef3ec76113f5c20f49561a48bb73bf03964d7f
sha512: 7746c46b4075fdd90105c8a94b0c92ba2968659be78da1b8a67afdbefdc655f7ae75c79c19f85cebd35fe67a77e46c50e5e87b4ffbd3e6cfe836603528d01f52
ssdeep: 12288:MCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaOyXkQ:MCdxte/80jYLT3U1jfsWaOyXkQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19C058C2273DDC360CB769173BF6A77016EBF78650630B85B2F880D79A950171262DBA3
sha3_384: 173f132ba1e93383d7d8a99c702955bc07a59e4fd3ebd27367312c29977ff48ebe5db41ee5450c98344ca9db394039f9
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2019-10-24 14:39:40

Version Info:
CompanyName: hZCuOQuLu
FileVersion: 0.0.0.0
Translation: 0x0809 0x04b0

Trojan:Win32/AutoitShellInj.A!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Script.Generic.4!c
MicroWorld-eScan	Gen:Variant.Strictor.178909
FireEye	Gen:Variant.Strictor.178909
CAT-QuickHeal	Trojan.AutoIt.Worm.A
ALYac	Gen:Variant.Strictor.178909
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Trojan ( 0054bc841 )
Alibaba	Malware:Win32/km_2cf5bf0.None
K7GW	Trojan ( 0054bc841 )
Cybereason	malicious.b932f6
Arcabit	Trojan.Strictor.D2BADD
VirIT	Trojan.Win32.MulDrop8.HPR
Cyren	W32/AutoIt.SQ.gen!Eldorado
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Autoit.OGC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Script.Generic
BitDefender	Gen:Variant.Strictor.178909
NANO-Antivirus	Trojan.Win32.Starter.gznoyo
Avast	AutoIt:Runner-BG [Trj]
Emsisoft	Gen:Variant.Strictor.178909 (B)
F-Secure	Worm.WORM/FakeExt.Gen8
DrWeb	Trojan.Starter.7878
VIPRE	Gen:Variant.Strictor.178909
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
Sophos	Mal/Generic-R
SentinelOne	Static AI – Suspicious PE
Avira	WORM/FakeExt.Gen8
Antiy-AVL	GrayWare/Autoit.WorkingDir.a
Xcitium	TrojWare.Win32.Autoit.OGH@8hon62
Microsoft	Trojan:Win32/AutoitShellInj.A!MTB
ZoneAlarm	HEUR:Trojan.Script.Generic
GData	Gen:Variant.Strictor.178909
Google	Detected
AhnLab-V3	Trojan/Win32.Starter.R241379
McAfee	Artemis!AB7AB26B932F
MAX	malware (ai score=86)
VBA32	Trojan.Starter
Cylance	unsafe
Panda	Trj/CI.A
Ikarus	Trojan.Win32.Autoit
AVG	AutoIt:Runner-BG [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/AutoitShellInj.A!MTB?

Trojan:Win32/AutoitShellInj.A!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X