Categories: Trojan

MSIL/TrojanDownloader.Agent.MEQ malicious file

The MSIL/TrojanDownloader.Agent.MEQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/TrojanDownloader.Agent.MEQ virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
A process attempted to delay the analysis task.
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Collects information about installed applications
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools

How to determine MSIL/TrojanDownloader.Agent.MEQ?


File Info:
name: F15AAEFA9FAD07FAF414.mlwpath: /opt/CAPEv2/storage/binaries/9379abb2a64a64626511145894e0f5d4479ae766b877f4ae8aa4906028122ad9crc32: 786F700Bmd5: f15aaefa9fad07faf4145e291424d01dsha1: 463d9fd38361175c12c4f9cb3a8c772fea474ba9sha256: 9379abb2a64a64626511145894e0f5d4479ae766b877f4ae8aa4906028122ad9sha512: b61b47a55b596bfd8770cccc42091b3a999c46ccdd2f6b0ebbf750eae1efddbb02e7122da5e516cd4acdeb1f45042d583f0c05a9c2b046d4cb6ccd6e7dc862e6ssdeep: 196608:jvGacofn0HBcYnkkDicM21ugs5mRmtWxEfGIAcmZ/Pj7E/P4KmIA4W1ICgvBsGEd:jveof0HBcYnkkDiCugs5mafGIK/r7ES/type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19DC60131768AC53BD56605B06A2CDBAF51287FB50F7280D7A3D85E6E18F08C25732E27sha3_384: 9f3b3d7e9a93a11b170617e8a9858fc4694d72af76d10b2d5a439a11e528a3d374e009221cdcca9630b06073c9bb0d03ep_bytes: e886060000e97afeffffcccccccccccctimestamp: 2021-04-23 07:52:46
Version Info:
CompanyName: FTU APPSFileDescription: Activation-Patch InstallerFileVersion: 1.0.0InternalName: Activation-PatchLegalCopyright: Copyright (C) 2022 FTU APPSOriginalFileName: Activation-Patch.exeProductName: Activation-PatchProductVersion: 1.0.0Translation: 0x0409 0x04b0

MSIL/TrojanDownloader.Agent.MEQ also known as:

Lionic	Trojan.MSIL.Crysan.m!c
MicroWorld-eScan	Trojan.GenericKD.50462263
McAfee	Artemis!F15AAEFA9FAD
Sangfor	Backdoor.MSIL.Crysan.gen
K7AntiVirus	Trojan-Downloader ( 005946141 )
BitDefender	Trojan.GenericKD.50462263
K7GW	Trojan-Downloader ( 005946141 )
Arcabit	Trojan.Generic.D301FE37
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MEQ
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
Alibaba	Backdoor:Win32/Stealer.b050a65c
Rising	Backdoor.Crysan!8.10ECA (CLOUD)
Ad-Aware	Trojan.GenericKD.50462263
Emsisoft	Trojan.GenericKD.50462263 (B)
TrendMicro	TROJ_GEN.R002C0WFJ22
FireEye	Trojan.GenericKD.50462263
Avira	BDS/Redcap.gbmbu
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.50462263
Cynet	Malicious (score: 99)
ALYac	Trojan.GenericKD.50462263
TrendMicro-HouseCall	TROJ_GEN.R002C0WFJ22
Tencent	Msil.Trojan-downloader.Agent.Eams
Fortinet	PossibleThreat.PALLAS.H
BitDefenderTheta	Gen:NN.ZexaF.34742.@x3@aq6TTHii
AVG	Win32:Trojan-gen