About “VirTool:MSIL/Kekeo.NT!MTB” infection

The VirTool:MSIL/Kekeo.NT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:MSIL/Kekeo.NT!MTB virus can do?

Authenticode signature is invalid
Binary file triggered YARA rule

How to determine VirTool:MSIL/Kekeo.NT!MTB?


File Info:
name: D9CD410A84051139C94B.mlw
path: /opt/CAPEv2/storage/binaries/3d40f26b74f5f29d378801636aa43e67dde53b034385b2a845085c1afc6e6ba7
crc32: 3AB812BC
md5: d9cd410a84051139c94b231553e57455
sha1: cbc8d616109e813e3cbdaff528254bb9dab1fade
sha256: 3d40f26b74f5f29d378801636aa43e67dde53b034385b2a845085c1afc6e6ba7
sha512: 58bebf25f0923c7837f23468a1b60067a3dc1d801d35ce1834b43f17a954db4a56c49c68d6d4c8132958759d9eae2dcf7ede4599c39056c3577a53addb145e44
ssdeep: 3072:IcYCncVzcf8zlLvjTv3wWbK5fjmZZkgZnVQc+KATN+1JsaPlPAX3QuN/LPfshOcW:4UWTHzKEZb7SpL3HIZfnpA6p2gJx1XU
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T12584E7D47BFA8BA5C09A4B3D91B9F94A3B34C10AFE17F383049021793E5675B1D4A923
sha3_384: 8a2fca6dba285fe18f8206916a8d1f93f1f98a987fce0a66767c270410b99850be1a61ecb85139fea14454c737b38e7b
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-10-09 13:08:46

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: george
FileVersion: 1.0.0.0
InternalName: george.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: george.exe
ProductName: george
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

VirTool:MSIL/Kekeo.NT!MTB also known as:

Bkav	W32.AIDetectMalware.CS
MicroWorld-eScan	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5
FireEye	Generic.mg.d9cd410a84051139
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	HackTool-FEY!D9CD410A8405
McAfee	HackTool-FEY!D9CD410A8405
Malwarebytes	Malware.AI.2244129036
Zillya	Tool.Rubeus.Win32.183
Sangfor	Hacktool.Win32.Kekeo.fireeye
K7AntiVirus	Riskware ( 0055f8b11 )
Alibaba	VirTool:MSIL/Kekeo.946d1e69
K7GW	Riskware ( 0055f8b11 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36802.xm0@a0Dd6Qf
Symantec	Trojan.Gen.MBT
Elastic	Windows.Hacktool.Rubeus
ESET-NOD32	a variant of MSIL/Riskware.Rubeus.B
TrendMicro-HouseCall	HackTool.MSIL.Rubeus.SM
ClamAV	Win.Trojan.HackTool_MSIL_Rubeus_1-9805032-0
Kaspersky	Trojan.Win32.Ruberoid.gen
BitDefender	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5
NANO-Antivirus	Trojan.Win32.Mlw.ibmbqg
Avast	Win32:Malware-gen
Tencent	Msil.Hacktool.Rubeus.Qgil
Emsisoft	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5 (B)
VIPRE	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5
TrendMicro	HackTool.MSIL.Rubeus.SM
Sophos	ATK/Rubeus-B
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=99)
Google	Detected
Varist	W32/Trojan.ISS.gen!Eldorado
Antiy-AVL	RiskWare/MSIL.Rubeus
Microsoft	VirTool:MSIL/Kekeo.NT!MTB
Arcabit	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5
ZoneAlarm	Trojan.Win32.Ruberoid.gen
GData	DeepScan:Generic.Trojan.Rubbie.Marte.A.D14FC9F5
AhnLab-V3	HackTool/Win32.Agent.C4262707
ALYac	Misc.Riskware.Rubeus
Cylance	unsafe
Rising	Hacktool.Kekeo!8.A21A (CLOUD)
MaxSecure	Trojan.Malware.110868776.susgen
Fortinet	Riskware/Rubeus
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
alibabacloud	Hacktool:Win/Rubeus

How to remove VirTool:MSIL/Kekeo.NT!MTB?

VirTool:MSIL/Kekeo.NT!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X