Categories: Trojan

MSIL/TrojanDownloader.Agent.PHR removal

The MSIL/TrojanDownloader.Agent.PHR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/TrojanDownloader.Agent.PHR virus can do?

CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid
Binary file triggered YARA rule

How to determine MSIL/TrojanDownloader.Agent.PHR?


File Info:
name: 77EF3AE9895CDC60903B.mlwpath: /opt/CAPEv2/storage/binaries/5b9b9f35f799f662e0d182c11d41cb63613e4dbeb84d18b22c16daaa1b3e14a3crc32: 977EF884md5: 77ef3ae9895cdc60903b61c7b181a79bsha1: d8a02a134c59ff10a621b64e0b3e95dfe0bcf619sha256: 5b9b9f35f799f662e0d182c11d41cb63613e4dbeb84d18b22c16daaa1b3e14a3sha512: 1d566b8c139f78d6edd46d8ac2a856640d70711a27cfc905b50735962d977350b311f7394ad6a00c69832e2b1bb78d0f704eeacfa6fb5969856b0d13f03df35dssdeep: 96:5IeQycXt4jjhQBZM+BNmSGRIijWHolXN3/RZvGg8HaJpomsZxmobFnU:i3xXt85SGwob7986PoBZMRtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F7020914BB989633F53ACFF198A393410338B3926952DBDD0CCC0A4E49E27984666F93sha3_384: 0e8b8928bff51c7fc1df1b088d79fdd01e486cc9b51cd6e99fba2d2c859485ea12c9992f9f5aa6407f082741141a2e87ep_bytes: ff250020400000000000000000000000timestamp: 2023-06-12 04:19:07
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: FileVersion: 1.0.0.0InternalName: PO 17201.exeLegalCopyright: LegalTrademarks: OriginalFilename: PO 17201.exeProductName: ProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Agent.PHR also known as:

Bkav	W32.AIDetectMalware.CS
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
FireEye	Gen:Heur.MSIL.Bladabindi.1
Skyhigh	BehavesLike.Win32.Downloader.xt
Cylance	unsafe
Zillya	Backdoor.Androm.Win32.111100
Sangfor	Downloader.Msil.Androm.Vipi
Alibaba	Backdoor:MSIL/Androm.bcf47423
K7GW	Trojan-Downloader ( 0059c9381 )
K7AntiVirus	Trojan-Downloader ( 0059c9381 )
Symantec	MSIL.Downloader!gen7
tehtris	Generic.Malware
ESET-NOD32	MSIL/TrojanDownloader.Agent.PHR
APEX	Malicious
TrendMicro-HouseCall	TROJ_GEN.R002C0DDB24
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Androm.gen
BitDefender	Gen:Heur.MSIL.Bladabindi.1
NANO-Antivirus	Trojan.Win32.Androm.jxcpfc
Tencent	Malware.Win32.Gencirc.13d0c164
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
Google	Detected
F-Secure	Heuristic.HEUR/AGEN.1323353
DrWeb	Trojan.DownloaderNET.649
VIPRE	Gen:Heur.MSIL.Bladabindi.1
TrendMicro	TROJ_GEN.R002C0DDB24
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Paloalto	generic.ml
Varist	W32/ABRisk.FXVP-7814
Avira	HEUR/AGEN.1323353
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Backdoor]/MSIL.Androm
Microsoft	Trojan:MSIL/AgentTesla.PA!MTB
Arcabit	Trojan.MSIL.Bladabindi.1
ZoneAlarm	HEUR:Backdoor.MSIL.Androm.gen
GData	Gen:Heur.MSIL.Bladabindi.1
AhnLab-V3	Trojan/Win.Injection.C5440490
McAfee	Artemis!77EF3AE9895C
VBA32	Downloader.MSIL.gen.rexp
Malwarebytes	Trojan.Downloader.MSIL
Panda	Trj/Chgt.AD
Rising	Backdoor.Androm!8.113 (CLOUD)
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.PHR!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.36804.am0@aKUCBwp
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
alibabacloud	Backdoor:MSIL/AgentTesla.PA!MTB