How to remove “MSIL/TrojanDownloader.Agent.MNH”?

The MSIL/TrojanDownloader.Agent.MNH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.MNH virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/TrojanDownloader.Agent.MNH?


File Info:
name: F88EEAE06FF851E4E3DB.mlw
path: /opt/CAPEv2/storage/binaries/8441e8cc757b9bde5877d28597523342ce183267a91129fcefecc1bf2ca33bf1
crc32: B240449D
md5: f88eeae06ff851e4e3db2d6e9e660cac
sha1: 650a832270c0ee2879a60a43b1ef18a27103a761
sha256: 8441e8cc757b9bde5877d28597523342ce183267a91129fcefecc1bf2ca33bf1
sha512: 3f40bda2d2d97933dca9b9a686936a0f5884efe846e18b865bc5183e921f175360919bfc5cde9a11dddf0baefd5917781e8776260e2f27ab6d755b559be6f895
ssdeep: 3072:dulrctt3vqQ80LosqL2/woEZNNhjc+kNL/FG32aJEr/IZRZ/9SQ4GTP5Z5ZGDKrs:dact5ZpwrEa1jSQDiEB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D2140810AFE4821AE26E5772E4B602518B75FAC37516EB4F1CD832ED1C73744AD122AF
sha3_384: 050519977ed4a1a6271a4a7acb5b18efd667f5499322e810845364ac278c8189bac61480f9ccca29d99853a937b458ec
ep_bytes: ff25ecfb42000000000000000000c0fb
timestamp: 2022-07-12 00:56:58

Version Info:
Translation: 0x0000 0x04b0
Comments: Coevery
FileDescription: Coevery
FileVersion: 1.0.0.0
InternalName: PtCiY.exe
LegalCopyright: Coevery Copyright ©  2016
OriginalFilename: PtCiY.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Agent.MNH also known as:

FireEye	Gen:Variant.Bulz.383607
McAfee	Artemis!F88EEAE06FF8
BitDefender	Gen:Variant.Bulz.383607
Cybereason	malicious.06ff85
Cyren	W32/MSIL_Kryptik.EOQ.gen!Eldorado
Symantec	MSIL.Downloader!gen7
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MNH
APEX	Malicious
Kaspersky	UDS:Trojan-PSW.MSIL.Reline.gen
MicroWorld-eScan	Gen:Variant.Bulz.383607
Avast	FileRepMalware [Misc]
Ad-Aware	Gen:Variant.Bulz.383607
Emsisoft	Gen:Variant.Bulz.383607 (B)
DrWeb	Trojan.Siggen9.56514
VIPRE	Gen:Variant.Bulz.383607
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Win32.SuspectCrc
GData	Gen:Variant.Bulz.383607
MAX	malware (ai score=82)
Arcabit	Trojan.Bulz.D5DA77
ZoneAlarm	UDS:Trojan-PSW.MSIL.Reline.gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ALYac	Gen:Variant.Bulz.383607
SentinelOne	Static AI – Suspicious PE
Fortinet	PossibleThreat
BitDefenderTheta	Gen:NN.ZemsilCO.34786.mm0@aOWDqYp
AVG	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_60% (W)

How to remove MSIL/TrojanDownloader.Agent.MNH?

MSIL/TrojanDownloader.Agent.MNH removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X