Malware

Should I remove “Downloader.MSIL.rexp”?

Malware Removal

The Downloader.MSIL.rexp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Downloader.MSIL.rexp virus can do?

  • CAPE extracted potentially suspicious content
  • .NET file is packed/obfuscated with SmartAssembly
  • Authenticode signature is invalid

How to determine Downloader.MSIL.rexp?


File Info:

name: 3B32340B110287DE3B13.mlw
path: /opt/CAPEv2/storage/binaries/13866a740d6c992bce683cecb57ccf2db716c5b6f06e37fcedc2f1e6f0437562
crc32: 2426DA30
md5: 3b32340b110287de3b13192d32f8acbd
sha1: 4eda7b18fd349419d692ea8a66daeb1ac723fa30
sha256: 13866a740d6c992bce683cecb57ccf2db716c5b6f06e37fcedc2f1e6f0437562
sha512: 3130483b5fc3d62cec7082acd61df534d141ed1f4002fc256cfec03d8d9422811d13a2b0541263a2c182639e9fb480b54ac8e430c2aa9b7a1b31a34a63722108
ssdeep: 6144:NUsEB66eBzMN/svkDo6VfdIAt9xZlTbWL:XEk2kf01X
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17464384493CB1EA3E29FA33BA8F156154770E812E79FDB8E568479E41C727329D01B23
sha3_384: c0c4dfaaf9f83764a1712bd237603b16e04779ca8b0425927c5dd41b69ea63aead55c131cfab2cfbd3a3bcf1bd738426
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-08-17 12:57:00

Version Info:

Translation: 0x0000 0x04b0
Comments: Opera Internet Browser
CompanyName: Opera Software
FileDescription: Opera Internet Browser
FileVersion: 89.0.4447.83
InternalName: batteryssss50.exe
LegalCopyright: Copyright Opera Software 2022
LegalTrademarks:
OriginalFilename: batteryssss50.exe
ProductName: Opera Internet Browser
ProductVersion: 89.0.4447.83
Assembly Version: 89.0.4447.83

Downloader.MSIL.rexp also known as:

BkavW32.AIDetectNet.01
SymantecMSIL.Downloader!gen8
APEXMalicious
Paloaltogeneric.ml
AvastFileRepMalware [Rat]
SentinelOneStatic AI – Suspicious PE
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
VBA32Downloader.MSIL.gen.rexp
MalwarebytesTrojan.MalPack
MaxSecureTrojan.Malware.300983.susgen
AVGFileRepMalware [Rat]

How to remove Downloader.MSIL.rexp?

Downloader.MSIL.rexp removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment