MSIL/TrojanDropper.Agent.FNK (file analysis)

The MSIL/TrojanDropper.Agent.FNK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDropper.Agent.FNK virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/TrojanDropper.Agent.FNK?


File Info:
name: EC6B5BA489BE5337604C.mlw
path: /opt/CAPEv2/storage/binaries/eeb347b2095b5aa7528ac8bb5b4532ac563e991897681a68aac5de6947c08344
crc32: 6489D8DC
md5: ec6b5ba489be5337604cc11f9a59152e
sha1: 6253c7096dc67b05bac2e1875d6ab49f85ff3070
sha256: eeb347b2095b5aa7528ac8bb5b4532ac563e991897681a68aac5de6947c08344
sha512: 62aab9dd20c680fd501497dc1cfb91e10ab41081ed078a2267e5e5d6cc6bc25c84936c8e12079b775f85c64315740bdbc4d2467cc3c26527c690747a25b5aead
ssdeep: 384:yJ5laHyokLoPXhVvF2aIP3E4hj9jP8cnuROHQIc7vumVm:nyo5vF2+419r8TOHQIc7vS
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1DF72CAE87F9574EBC47CF97492809143B570E43A28810B6FD58282CFFB1699268D70EE
sha3_384: 2d82c32d2eba2ced72215a16e8e7c95a72bf31b217d6ebd6ee649e91fd84ace880075e35b3236752bad2c8fd36ecc308
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-20 08:27:01

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: ?
LegalCopyright:  
OriginalFilename: ?
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/TrojanDropper.Agent.FNK also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.Qbot.7!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
FireEye	Generic.mg.ec6b5ba489be5337
McAfee	Artemis!EC6B5BA489BE
Cylance	Unsafe
Sangfor	Banker.Msil.Agent.V36w
K7AntiVirus	Trojan ( 005944291 )
Alibaba	TrojanBanker:MSIL/Generic.8ec3e738
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Qbot.KI.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FNK
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Banker.MSIL.Qbot.gen
Avast	Win32:BankerX-gen [Trj]
Tencent	Msil.Trojan-Banker.Qbot.Fwnw
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1234980
Antiy-AVL	Trojan/Generic.ASMalwS.7D9A
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Trojan.Agent.K429JM
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C4898177
Malwarebytes	Trojan.Dropper.MSIL.Generic
TrendMicro-HouseCall	TROJ_GEN.R002H0CIK22
Rising	Dropper.Agent!8.2F (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.FNK!tr
AVG	Win32:BankerX-gen [Trj]
Cybereason	malicious.96dc67
Panda	Trj/GdSda.A

How to remove MSIL/TrojanDropper.Agent.FNK?

MSIL/TrojanDropper.Agent.FNK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X