MSIL/TrojanDownloader.Small.COA (file analysis)

The MSIL/TrojanDownloader.Small.COA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Small.COA virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/TrojanDownloader.Small.COA?


File Info:
name: 3C7F5D765E4259DBACDC.mlw
path: /opt/CAPEv2/storage/binaries/09d8401f5aacea45d5b4279fecd1d926c3fa025b4a933b3551ec08ead760bb79
crc32: 9D1B63A6
md5: 3c7f5d765e4259dbacdc1a95531126f6
sha1: 0e8917291df05d6afd58634aabfc0ff194e094af
sha256: 09d8401f5aacea45d5b4279fecd1d926c3fa025b4a933b3551ec08ead760bb79
sha512: 719d392685efac463e2dac32507c1794ee4e5f9e77a7b519943a7a3c380d1340980d97f961e3552825c6a508f123e4f8549d5b198818607c5ed87b22103ad9d3
ssdeep: 48:6/R4JYcgJWV6jUlo7jhhul9feFbuulxxxVKqXSfbNtm:04JYcLcUm79XFtVxEzNt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12A916401A7E88127F173073409B3431177B9F9119D2B871E68D9021EAD21790DD93BF2
sha3_384: 76abffa14992241712c5ea6091b27f489e77064f284880b5bb20614d53d16690f351cca3a06933cc4480fdc46e06584a
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-08-23 13:30:58

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: Program.exe
LegalCopyright:  
OriginalFilename: Program.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/TrojanDownloader.Small.COA also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.6286
FireEye	Generic.mg.3c7f5d765e4259db
Zillya	Downloader.Small.Win32.140453
BitDefenderTheta	Gen:NN.ZemsilF.34294.am0@au8Vnip
ESET-NOD32	a variant of MSIL/TrojanDownloader.Small.COA
Kaspersky	HEUR:Trojan-Spy.MSIL.Quasar.gen
BitDefender	IL:Trojan.MSILZilla.6286
Ad-Aware	IL:Trojan.MSILZilla.6286
SentinelOne	Static AI – Malicious PE
Emsisoft	IL:Trojan.MSILZilla.6286 (B)
Ikarus	Trojan-Downloader.MSIL.Small
GData	IL:Trojan.MSILZilla.6286
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Trojan-gen.R435581
ALYac	IL:Trojan.MSILZilla.6286
Malwarebytes	Spyware.Quasar
APEX	Malicious
MAX	malware (ai score=86)
Fortinet	MSIL/Small.COA!tr
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.300983.susgen

How to remove MSIL/TrojanDownloader.Small.COA?

MSIL/TrojanDownloader.Small.COA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X