Trojan

MSIL/TrojanDownloader.Agent.PHW malicious file

Malware Removal

The MSIL/TrojanDownloader.Agent.PHW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/TrojanDownloader.Agent.PHW virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine MSIL/TrojanDownloader.Agent.PHW?



File Info:

name: 7C6B5D42673F1637AF11.mlw
path: /opt/CAPEv2/storage/binaries/657b71b90135fcefac161313d75483aee5dee8c2d39203ec014b8d785ca843ca
crc32: 0D4AF7FE
md5: 7c6b5d42673f1637af11eb5740285fa4
sha1: 815392afb5cad3ea7f82b8d1120e39d872a101ba
sha256: 657b71b90135fcefac161313d75483aee5dee8c2d39203ec014b8d785ca843ca
sha512: 6936ce9a4c57b07976e5e2f24a483d62d22cdafb1e37a749d051f72edca1bf28e52014a47f2145d1cab88b0ba9c45c317b32237840ca899d63a2a07d6597cb6e
ssdeep: 196608:DkYPTj81eFaBO5kFj0zA/YXqIA+XSlyORmlM1wRDN2f/xcEWCq5xI:D5rVFL5kp/mMUlOwRDcEXx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D8B633FEF63E63C4CD2175729DB4A91D401920DE6B82F039EC1B42773A89D2394A9772
sha3_384: f3a432399ca11368238dd72d0a04d301644b5518d7510bddde38578e084ef9db7068f0f4bf82db518d73fc0ad2e55b08
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-06-15 03:22:29


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: statemobile.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: statemobile.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Agent.PHW also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
FireEyeGeneric.mg.7c6b5d42673f1637
Cylanceunsafe
SangforSuspicious.Win32.Save.a
AlibabaTrojan:MSIL/Inject.563b191c
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZemsilF.36250.@p0@aKUMk0
CyrenW32/ABRisk.NXXN-6547
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.PHW
APEXMalicious
KasperskyHEUR:Trojan-PSW.MSIL.Stealerc.gen
AvastWin32:PWSX-gen [Trj]
F-SecureTrojan.TR/Dropper.Gen
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
Trapminemalicious.high.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataWin32.Trojan.Agent.WPZIJ4
GoogleDetected
AviraTR/Dropper.Gen
Antiy-AVLTrojan/MSIL.GenKryptik
ZoneAlarmHEUR:Trojan-PSW.MSIL.Stealerc.gen
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
McAfeeArtemis!7C6B5D42673F
MalwarebytesGeneric.Malware/Suspicious
TrendMicro-HouseCallTROJ_GEN.R002H0AFH23
IkarusTrojan.MSIL.Inject
FortinetMSIL/GenKryptik.GKRQ!tr
AVGWin32:PWSX-gen [Trj]
Cybereasonmalicious.fb5cad
DeepInstinctMALICIOUS

How to remove MSIL/TrojanDownloader.Agent.PHW?

MSIL/TrojanDownloader.Agent.PHW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment