Trojan.Downloader.ERR (file analysis)

The Trojan.Downloader.ERR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Downloader.ERR virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid

How to determine Trojan.Downloader.ERR?


File Info:
name: D7267DA297BFC2F767AA.mlw
path: /opt/CAPEv2/storage/binaries/3c5a61f8829568cddd7f687354ab2b9f9ba4024e95a6ec01f61197f3a4439ae0
crc32: 1F65A54A
md5: d7267da297bfc2f767aafd64eff7a1d9
sha1: ae481e31f275c3f21c6294de8d78e267d04557c0
sha256: 3c5a61f8829568cddd7f687354ab2b9f9ba4024e95a6ec01f61197f3a4439ae0
sha512: 93368744a27b234936a111ec6d4599d3546391b1c5d6ec5d19c281d02a1ea69d50707dd64bdcfcc1817353e366fddefc881007858fbce551b27e4dc6c6cf0b60
ssdeep: 96:s/elwj2R+xxqCmybIAQFsmjKGWRdbX4mzPZt79xZL8M8h24IKjGUmcmqCJQPhzVu:Kg28AyyRL9xZYWmlhzV/t2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14612E704B7E94331F9BF8B39BC7346105676FA538A33CF0D58D9A24A1A323944A15FA2
sha3_384: 215e217bdd638e42dd8c50c1430f3cecabf65e7b26faeb43cecdb81ef9a3c19427bb2d9847b7fd1338b2335fab3f8008
ep_bytes: ff250020400000000000000000000000
timestamp: 2019-05-08 02:18:41

Version Info:
Translation: 0x0000 0x04b0
Comments: cluldccx44o
CompanyName: 54545y50i4w
FileDescription: myiy5g1bxca
FileVersion: 4.5.2.2
InternalName: nha3l2ogwaf.exe
LegalCopyright: 0jnexbzvc2a
OriginalFilename: nha3l2ogwaf.exe
ProductName: myiy5g1bxca
ProductVersion: 4.5.2.2
Assembly Version: 4.5.2.2

Trojan.Downloader.ERR also known as:

Lionic	Worm.MSIL.Guap.q!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.15083
MicroWorld-eScan	Gen:Trojan.Mardom.MN.11
FireEye	Generic.mg.d7267da297bfc2f7
CAT-QuickHeal	Worm.MsilFC.S9417149
McAfee	Artemis!D7267DA297BF
Cylance	Unsafe
Zillya	Downloader.Agent.Win32.400672
Sangfor	Worm.MSIL.Guap.gen
K7AntiVirus	Trojan-Downloader ( 0054b2571 )
Alibaba	Worm:MSIL/MalwareX.a1e7337e
K7GW	Trojan-Downloader ( 0054b2571 )
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	Gen:NN.ZemsilF.34084.am0@aKeUhqb
Cyren	W32/SmallTrojan.BV.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.FKM
Paloalto	generic.ml
ClamAV	Win.Packed.Azorult-7436406-1
Kaspersky	HEUR:IM-Worm.MSIL.Guap.gen
BitDefender	Gen:Trojan.Mardom.MN.11
NANO-Antivirus	Trojan.Win32.Razy.hgiduq
Avast	Win32:MalwareX-gen [Trj]
Tencent	Msil.Trojan-downloader.Agent.Wpsw
Ad-Aware	Gen:Trojan.Mardom.MN.11
Sophos	Mal/Generic-S
Comodo	Malware@#lfp7nw9mcnau
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.zt
Emsisoft	Gen:Trojan.Mardom.MN.11 (B)
Ikarus	Trojan-Downloader.MSIL.Agent
GData	Gen:Trojan.Mardom.MN.11
Avira	TR/Dropper.Gen
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Generic.ASMalwS.2FEDADD
Microsoft	Trojan:Win32/AgentTesla!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.RL_Generic.C3995718
VBA32	TScope.Trojan.MSIL
ALYac	Gen:Trojan.Mardom.MN.11
Malwarebytes	Trojan.Downloader.ERR
APEX	Malicious
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	MSIL/Agent.FKM!tr
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.297bfc
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.74035307.susgen

How to remove Trojan.Downloader.ERR?

Trojan.Downloader.ERR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X