Categories: Trojan

TrojanDownloader:MSIL/NanoCore.D!MTB information

The TrojanDownloader:MSIL/NanoCore.D!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:MSIL/NanoCore.D!MTB virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine TrojanDownloader:MSIL/NanoCore.D!MTB?


File Info:
name: DEF0673DF2BE5ED74D32.mlwpath: /opt/CAPEv2/storage/binaries/1760a4ba91f5c69b7b1a24c610f46c846ebeb8a4683bcb5369dad44b0cde24f5crc32: 13497BD9md5: def0673df2be5ed74d32fdc202aa477esha1: 687bd4e3bac1611600880ca2c3527fdca434d9c1sha256: 1760a4ba91f5c69b7b1a24c610f46c846ebeb8a4683bcb5369dad44b0cde24f5sha512: 8c10dac70265cd78f1231abc094741e149f1fb5f73ae64387ef9b2f8c342a7cb6e444d5bc90f217f5fbe52443e5e2b8e9c7d9a34e1244e705c4c70d71afac630ssdeep: 384:F0Oss/gUGUcPb5SV2vHjjAtTJswpwKi8ZpHzGov8RoH7LKAtTJswpwKi8ZpHzGoy:KI0DjYTG7iRPxKYTG7iRPqtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13FF24BA63B14E091CDC64E71A8C7CAB24D30F662AE94099B31F0864F5DB27D57E6422Fsha3_384: b6e5cea24046f184557fd5903b52effc7cf8e05a25985d6581c53f7b779ac9d895b96e42d869ef50aa8150b59e14dc57ep_bytes: ff250020400000000000000000000000timestamp: 2039-02-16 14:05:22
Version Info:
Translation: 0x0000 0x04b0Comments: SSH, Telnet, Rlogin, and SUPDUP clientCompanyName: Simon TathamFileDescription: SSH, Telnet, Rlogin, and SUPDUP clientFileVersion: 0.77.0.0InternalName: 888.exeLegalCopyright: Copyright © 1997-2022 Simon Tatham.LegalTrademarks: OriginalFilename: 888.exeProductName: PuTTY suiteProductVersion: 0.77.0.0Assembly Version: 0.77.0.0

TrojanDownloader:MSIL/NanoCore.D!MTB also known as:

Lionic	Trojan.Win32.PsDownload.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.22406
FireEye	Generic.mg.def0673df2be5ed7
McAfee	RDN/Generic Downloader.x
Malwarebytes	Trojan.Downloader.MSIL.Generic
VIPRE	IL:Trojan.MSILZilla.22406
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:MSIL/NanoCore.7aea1d5f
K7GW	Trojan-Downloader ( 005967611 )
K7AntiVirus	Trojan-Downloader ( 005967611 )
Cyren	W32/MSIL_Agent.DRO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.MVU
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-Downloader.MSIL.PsDownload.gen
BitDefender	IL:Trojan.MSILZilla.22406
NANO-Antivirus	Trojan.Win32.PsDownload.jrdzzp
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-Downloader.Ader.Njgl
Sophos	Troj/DwnLd-AFX
F-Secure	Heuristic.HEUR/AGEN.1357246
DrWeb	Trojan.DownLoaderNET.446
Zillya	Downloader.Agent.Win32.484070
McAfee-GW-Edition	RDN/Generic Downloader.x
Emsisoft	IL:Trojan.MSILZilla.22406 (B)
SentinelOne	Static AI – Malicious PE
GData	IL:Trojan.MSILZilla.22406
Jiangmin	TrojanDownloader.MSIL.amdx
Avira	HEUR/AGEN.1357246
Antiy-AVL	Trojan[Downloader]/MSIL.PsDownload
Arcabit	IL:Trojan.MSILZilla.D5786
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.PsDownload.gen
Microsoft	TrojanDownloader:MSIL/NanoCore.D!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5218077
VBA32	Downloader.MSIL.gen.rexp
ALYac	IL:Trojan.MSILZilla.22406
MAX	malware (ai score=84)
Cylance	unsafe
Panda	Trj/Chgt.AD
Rising	Downloader.Agent!8.B23 (CLOUD)
Yandex	Trojan.DL.Agent!ccnND2pHHrE
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.73750922.susgen
Fortinet	MSIL/Agent.MVU!tr.dldr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.df2be5
DeepInstinct	MALICIOUS