MSIL/TrojanDownloader.Agent.NMO malicious file

The MSIL/TrojanDownloader.Agent.NMO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Agent.NMO virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/TrojanDownloader.Agent.NMO?


File Info:
name: DF2745E8AE4AD1A3AA3C.mlw
path: /opt/CAPEv2/storage/binaries/3bcf1f4732835c14c9615109c1275a520d96d768da30d4a0005e8e68f7fb7f56
crc32: AF81463D
md5: df2745e8ae4ad1a3aa3c4d6eed35d937
sha1: a2edc822097b2b5fa1c42aeeddd81483b1722151
sha256: 3bcf1f4732835c14c9615109c1275a520d96d768da30d4a0005e8e68f7fb7f56
sha512: 1e3aa1b861ada8373d7298f2588e62dbf370f4e8aedccad188ff6ea654cc909fd08e6b7aa724a0a6c98e23ecff7e1a7547996943cbafcfb83f83953f4cf9205c
ssdeep: 768:cLxl4JLkrxr/rYrPrgr9rnrurZrfrwrmr7ryrArSrxrTrbrvSHFl0GMTusEi2/ls:aSHf0gsEltGbVx4LU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13C63A89B3540C89CCE6D24F76306408073E99CFFD958A2486BCE32572FE65E2583676E
sha3_384: ac7027b5202a8629357d7b4e61c9083f6ae464244c920138ee108b6b7c5e85a7371d62df24a5bee0758a815bdb3c8762
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-26 08:16:00

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: JxzwYzvEYdxxf.exe
LegalCopyright:  
OriginalFilename: JxzwYzvEYdxxf.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/TrojanDownloader.Agent.NMO also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.Bladabindi.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.62608458
McAfee	RDN/Generic BackDoor
Cylance	Unsafe
VIPRE	Trojan.GenericKD.62608458
Sangfor	Downloader.Msil.Leonem.Vcr6
K7AntiVirus	Trojan-Downloader ( 00598b1f1 )
K7GW	Trojan-Downloader ( 00598b1f1 )
Cybereason	malicious.2097b2
Cyren	W32/ABRisk.ULKP-6764
Symantec	MSIL.Downloader!gen7
ESET-NOD32	MSIL/TrojanDownloader.Agent.NMO
APEX	Malicious
Paloalto	generic.ml
Alibaba	Backdoor:MSIL/Bladabindi.1bfd5633
Ad-Aware	Trojan.GenericKD.62608458
Sophos	Mal/Generic-S
Comodo	Malware@#130qo7ey4f6l0
BitDefenderTheta	Gen:NN.ZemsilF.34754.em0@aK@jUhe
Zillya	Downloader.Agent.Win32.491586
TrendMicro	TROJ_GEN.R002C0DIT22
McAfee-GW-Edition	BehavesLike.Win32.AdwareTskLnk.lm
Emsisoft	Trojan.GenericKD.62608458 (B)
Avira	HEUR/AGEN.1240957
Antiy-AVL	Trojan/Generic.ASMalwS.3DAC
Kingsoft	Win32.Hack.Undef.(kcloud)
Arcabit	Trojan.Generic.D3BB544A
Google	Detected
AhnLab-V3	Trojan/Win.Leonem.C5246209
Acronis	suspicious
MAX	malware (ai score=82)
Malwarebytes	Trojan.Downloader.MSIL.Generic
TrendMicro-HouseCall	TROJ_GEN.R002C0DIT22
Tencent	Msil.Trojan-Downloader.Ader.Ogil
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Agent.BEU!tr.dldr
Panda	Trj/GdSda.A

How to remove MSIL/TrojanDownloader.Agent.NMO?

MSIL/TrojanDownloader.Agent.NMO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X