MSIL/TrojanDownloader.Agent.KKF removal guide

The MSIL/TrojanDownloader.Agent.KKF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.KKF virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/TrojanDownloader.Agent.KKF?


File Info:
name: FF009DC57A4505558933.mlw
path: /opt/CAPEv2/storage/binaries/03035bd99a38cc31e72c6c0d3b24bf5d4aec480888ec5871667cb4fafa7219b2
crc32: 4904EFDA
md5: ff009dc57a4505558933c08db6fe7264
sha1: cf1b0f067a14d0c8076aad0ef37f2de735440fd1
sha256: 03035bd99a38cc31e72c6c0d3b24bf5d4aec480888ec5871667cb4fafa7219b2
sha512: 1816451324dd59e6f463e38b3d67f8337150b226628ddb4333af8cfa8f106c863cc70b3ecd8bc220949705403d51001503ce21d6d8cb697514b0e84e8a2b320d
ssdeep: 192:GaSP8ZNhNWBxrZlDPzMiwj05iLzGBv+d2/NFLCM5YWcdErkZLJH:GsNWBxrZlDPz6uBG4/NFLCM5YBEY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T114520A5C3758417AD7774F7039E23A9C85BF9BB754128E8F248B332A99A16808F72731
sha3_384: 5ccfae311247ecf0cd26ca0c10f6177fe1b9afeca034381dcae1ffa047acb5454fa569c368012182bfb9997cabbab0d7
ep_bytes: ff250020400000000000000000000000
timestamp: 2067-12-22 07:25:51

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: SimpleLoader
FileVersion: 1.0.0.0
InternalName: SimpleLoader.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: SimpleLoader.exe
ProductName: SimpleLoader
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Agent.KKF also known as:

DrWeb	Trojan.PWS.Stealer.32254
MicroWorld-eScan	Trojan.GenericKD.48370987
FireEye	Generic.mg.ff009dc57a450555
ALYac	Trojan.GenericKD.48370987
Malwarebytes	Spyware.PasswordStealer
Zillya	Trojan.Stealer.Win32.21954
Cybereason	malicious.67a14d
BitDefenderTheta	Gen:NN.ZemsilF.34232.am0@ayO!3qe
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.KKF
TrendMicro-HouseCall	TROJ_GEN.R06CC0PBB22
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.48370987
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-downloader.Agent.Edwy
Ad-Aware	Trojan.GenericKD.48370987
Sophos	Mal/Generic-S
Comodo	Malware@#mjf395xw84p5
Emsisoft	Trojan.GenericKD.48370987 (B)
Ikarus	Trojan.Agent
Jiangmin	TrojanSpy.MSIL.cdbg
Avira	TR/Downloader.hiehc
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASMalwS.3523DF9
Gridinsoft	Ransom.Win32.Sabsik.sa
GData	Trojan.GenericKD.48370987
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C4958636
VBA32	TScope.Trojan.MSIL
APEX	Malicious
SentinelOne	Static AI – Suspicious PE
Fortinet	PossibleThreat
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSIL/TrojanDownloader.Agent.KKF?

MSIL/TrojanDownloader.Agent.KKF removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X