MSIL/TrojanDownloader.Agent.NHO (file analysis)

The MSIL/TrojanDownloader.Agent.NHO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.NHO virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/TrojanDownloader.Agent.NHO?


File Info:
name: 3B909EA308E59E743389.mlw
path: /opt/CAPEv2/storage/binaries/5957d516c8a494e6b86284aa56f80c54182517ae64025e09370e9213ec4b73d3
crc32: 31B6491D
md5: 3b909ea308e59e743389db4221c71f5e
sha1: c64ae2eb98ab80b8ce242c826d0c0bcfa8afe4c3
sha256: 5957d516c8a494e6b86284aa56f80c54182517ae64025e09370e9213ec4b73d3
sha512: e9e5a3e0e19c7c85fe12aa407c5d8dfa472a5ca4072189b51df5017e8500872f2ef26d45ff7172b3ef5f0e60b5a1585ce1a8bb50d759ae2ab2bbce6e831f209a
ssdeep: 48:6zGROkD/yG4rF8rqXf86hruo4L3ReQNMj/EGxgncfZym/RPiFpsVtiOlz+gaqFSY:lRFPBrWhqrL3Re7/Rxgna5lp+gazNt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18EC1C700F7D81376DEB70BB968B793414278FB929C968FAC2890651F6D133518A72AB0
sha3_384: 036287149ea9fda8c36d433f9e7ce9ee5b5b3fcc9e002ab44152110d45107cd49ddfed21e705de2fe985ff8ea9ddb55c
ep_bytes: ff250020400000000000000000000000
timestamp: 2059-09-26 04:20:49

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: Ahzpdcsry.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: Ahzpdcsry.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Agent.NHO also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
FireEye	Generic.mg.3b909ea308e59e74
CrowdStrike	win/malicious_confidence_60% (D)
Symantec	MSIL.Downloader!gen8
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.NHO
APEX	Malicious
Kaspersky	VHO:Trojan-Downloader.MSIL.PsDownload.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	VHO:Trojan-Downloader.MSIL.PsDownload.gen
GData	MSIL.Trojan-Downloader.Agent.BJU
VBA32	Downloader.MSIL.gen.rexp
Cylance	Unsafe
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34646.am0@aS6hm9g
Cybereason	malicious.b98ab8

How to remove MSIL/TrojanDownloader.Agent.NHO?

MSIL/TrojanDownloader.Agent.NHO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X