About “MSIL/TrojanDownloader.Agent.MHM” infection

The MSIL/TrojanDownloader.Agent.MHM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.MHM virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/TrojanDownloader.Agent.MHM?


File Info:
name: 5778FFD49763F8647660.mlw
path: /opt/CAPEv2/storage/binaries/169632a9b4bc4b5783d765050b87e1fe720c505e13d0d22937b2a83a73dbe008
crc32: 5820EC40
md5: 5778ffd49763f86476605abe95c5045f
sha1: a3762641d2874f1e6c05b96dd1242dff1f4d98e3
sha256: 169632a9b4bc4b5783d765050b87e1fe720c505e13d0d22937b2a83a73dbe008
sha512: 502a1954e9555b0f765cd8f2ca22d058a92de87541357943d610a8185b643f3223534daa3286710da69e2a748036b25d3171f96288b88e51eeab07052e154120
ssdeep: 192:mJA9X4gKvylKd5HAzm1mQmGudjR7V7njhdLtWWKo52WH:B4RvVd5HeYkdJdRWWfYW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A922EA06ABE9C632D5A10A764C6347805A3CF65A9C63DB1FBD8CB10D6DA23548BD0B78
sha3_384: bb41c7fdde9c48f2c49ccf1274ebc9459d56f258c953a262b927477880840b8e4274f411ed44d4752c3b223dc03227ea
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-06-23 08:11:20

Version Info:
Translation: 0x0000 0x04b0
Comments: Screen Reader
CompanyName: Microsoft Corporation
FileDescription: Screen Reader
FileVersion: 6.3.9600.17415
InternalName: Vpicpyx.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: 
OriginalFilename: Vpicpyx.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.3.9600.17415
Assembly Version: 6.3.9600.17415

MSIL/TrojanDownloader.Agent.MHM also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
FireEye	Generic.mg.5778ffd49763f864
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Cyren	W32/MSIL_Kryptik.GXH.gen!Eldorado
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MHM
APEX	Malicious
Kaspersky	UDS:Trojan-Downloader.MSIL.Seraph.gen
Avast	DropperX-gen [Drp]
Sophos	Mal/Generic-S + Troj/Krypt-LV
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
Ikarus	Trojan-Downloader.MSIL.Agent
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!5778FFD49763
Malwarebytes	Backdoor.Quasar
SentinelOne	Static AI – Suspicious PE
Fortinet	MSIL/Agent.MAJ!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34742.am0@aq8C0Hj
AVG	DropperX-gen [Drp]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSIL/TrojanDownloader.Agent.MHM?

MSIL/TrojanDownloader.Agent.MHM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X