Backdoor:MSIL/DCRat!MTB (also known as “Remcos” or “RecomsRAT”) is a type of remote access Trojan (RAT) that can be used to gain unauthorized access to a victim’s computer. It is a sophisticated backdoor that allows an attacker to take control of the infected computer and perform a range of malicious activities.
Backdoor:MSIL/DCRat!MTB is typically spread through spam emails, malicious websites, or by exploiting vulnerabilities in software. Once it infects a computer, it can perform a range of malicious activities, such as stealing sensitive information (such as login credentials and financial data), capturing screenshots, logging keystrokes, and even hijacking the victim’s webcam and microphone.
DCRat is a dangerous and sophisticated malware that can be difficult to detect and remove. It is important to use up-to-date antivirus software, keep all software up-to-date with security patches, and exercise caution when opening emails or downloading files from unknown sources to minimize the risk of infection.
What is Backdoor:MSIL/DCRat!MTB Virus?
Backdoor:MSIL/DCRat!MTB is a dangerous malware that can infect your system after engaging in provoking activities, such as opening suspicious emails, clicking on suspicious banners, or installing software from dubious sources. Once it infects your computer, this malware can cause a lot of harm to your system and your files. It is crucial to act quickly and take steps to remove it.
Summary of Backdoor:MSIL/DCRat!MTB Virus Actions:
- Dynamically loads imported functions
- Contains an unknown PE section name indicative of packing
- Likely contains encrypted or compressed data
- Invalid Authenticode signature
- Encrypts documents stored on the target’s disk drive
- Blocks the launch of .exe files of security tools
- Blocks the launch of installation files of anti-malware apps
Protect your computer by avoiding engaging in provoking activities and always downloading software from trusted sources. If you suspect that your computer may be infected with Backdoor:MSIL/DCRat!MTB, act quickly to remove it to prevent further harm to your system.
Where did I get the Backdoor:MSIL/DCRat!MTB?

Malicious email message. This one tricks you to open the phishing website.
Avoiding it looks quite easy, but still demands a lot of awareness. Malware can hide in various places, and it is better to prevent it even before it invades your PC than to trust in an anti-malware program. Essential cybersecurity knowledge is just an essential thing in the modern-day world, even if your relationship with a computer stays on YouTube videos. That may save you a lot of time and money which you would certainly spend while trying to find a fixing guide.
Backdoor:MSIL/DCRat!MTB malware technical details
File Info:
name: FB41E1B1581B31F961F4.mlwpath: /opt/CAPEv2/storage/binaries/5aa4af2a499fc0bd6f3a65e5ab5bf5a66ffd20779c60cae76bcb41144dbb08dfcrc32: 4D3AC3B7md5: fb41e1b1581b31f961f4b9144cb7603csha1: e41b9212c43a5aa0aba63eaa0e868c5e969bfbc5sha256: 5aa4af2a499fc0bd6f3a65e5ab5bf5a66ffd20779c60cae76bcb41144dbb08dfsha512: d08afd113e9dc941ab626049a9ac8bfedb5a2fde788cc473cfce4ed909426a5c11ccde6c6313797a2f5db4b48dfd129c8075535bad91bf963375dab1ccf76580ssdeep: 24576:gcqbBXNCnFGAT9nE+5VmgFWhp2Wd7hKN0OFjX6OYJQI3SJKPWGDai2t+4:g7bx4oA97czhWFu+5s+GDo0type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14E556B123A44CE02E1691A3BD9EF805447ACED417A72DB1A7E6F339D65523A70E0E1CFsha3_384: d200d71591640f7f08adb82b21f93c1788120e996d9b5d9cb74ad5c997d93924d80ff901b68b78174630c948ca335e4bep_bytes: ff250020400000000000000000000000timestamp: 2021-11-21 01:09:22Version Info:
ProductName: CwRrreIELDFMT4fqmNpSwRCompanyName: VHnyJGZvhWInternalName: NykjPAwfDVGE9UwXLshNT.exeLegalCopyright: H5Vh697vQq0djIlI8p1bO8OComments: mLkOriginalFilename: NL9JYeXcUaDwhREjNWfTgC.exeProductVersion: 18.812.247.512FileVersion: 301.231.92.794Translation: 0x0409 0x0514
Backdoor:MSIL/DCRat!MTB also known as:
| Lionic | Trojan.MSIL.Stealer.l!c |
| Elastic | malicious (high confidence) |
| DrWeb | BackDoor.QuasarNET.5 |
| MicroWorld-eScan | IL:Trojan.MSILZilla.9872 |
| FireEye | Generic.mg.fb41e1b1581b31f9 |
| McAfee | Artemis!FB41E1B1581B |
| Cylance | Unsafe |
| Zillya | Trojan.Agent.Win32.2586614 |
| Sangfor | Suspicious.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Alibaba | TrojanSpy:MSIL/Stealer.1bcd1656 |
| K7GW | Spyware ( 005807381 ) |
| K7AntiVirus | Spyware ( 005807381 ) |
| BitDefenderTheta | Gen:NN.ZemsilF.34114.ur0@aq27CIii |
| Cyren | W32/MSIL_Agent.LQ.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of MSIL/Spy.Agent.DEK |
| APEX | Malicious |
| Paloalto | generic.ml |
| ClamAV | Win.Malware.Uztuby-9848412-0 |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Stealer.gen |
| BitDefender | IL:Trojan.MSILZilla.9872 |
| NANO-Antivirus | Trojan.Win32.Stealer.jjcgqh |
| Avast | Win32:RansomX-gen [Ransom] |
| Tencent | Msil.Trojan-spy.Stealer.Edwz |
| Ad-Aware | IL:Trojan.MSILZilla.9872 |
| Sophos | ML/PE-A |
| TrendMicro | TROJ_GEN.R002C0WL521 |
| Emsisoft | IL:Trojan.MSILZilla.9872 (B) |
| Ikarus | Trojan.MSIL.Spy |
| Avira | HEUR/AGEN.1144842 |
| Antiy-AVL | Trojan/Generic.ASMalwS.34DEBF3 |
| Microsoft | Backdoor:MSIL/DCRat.GG!MTB |
| GData | IL:Trojan.MSILZilla.9872 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.DC.C4650212 |
| VBA32 | TScope.Trojan.MSIL |
| ALYac | IL:Trojan.MSILZilla.9872 |
| MAX | malware (ai score=80) |
| Malwarebytes | Spyware.PasswordStealer.MSIL |
| TrendMicro-HouseCall | TROJ_GEN.R002C0WL521 |
| Yandex | TrojanSpy.Agent!k6Zhxp06gQc |
| SentinelOne | Static AI – Malicious PE |
| eGambit | Unsafe.AI_Score_99% |
| Fortinet | MSIL/Agent.DEK!tr.spy |
| AVG | Win32:RansomX-gen [Ransom] |
| Cybereason | malicious.1581b3 |
| Panda | Trj/CI.A |
| MaxSecure | Trojan.Malware.73709669.susgen |
Leave a Comment