TrojanDownloader:MSIL/NjRAT.G!MTB removal tips

The TrojanDownloader:MSIL/NjRAT.G!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:MSIL/NjRAT.G!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine TrojanDownloader:MSIL/NjRAT.G!MTB?


File Info:
name: 0358A265D732992B4AF2.mlw
path: /opt/CAPEv2/storage/binaries/ab6aaa4923ad57bab9c32282ac83050fe43928316a88ca92638d05ab5440f9c6
crc32: 6389706A
md5: 0358a265d732992b4af2ede41e63ce2b
sha1: bbf9228d83d411afe5db29ada0594ea8903ead7e
sha256: ab6aaa4923ad57bab9c32282ac83050fe43928316a88ca92638d05ab5440f9c6
sha512: 62b890c26154b7fdd3b244b7e36c34e54a8efd20d51faf9da5c24c88d91c18434fa1f381d98eb17d5c835e6a98bcb9e592df8693706ce27e8b630891e4c1e779
ssdeep: 192:hJxahcF6oNJ6b2ewNGOwp48t4oTcIW1VnUrMPFJ38TVB23Hft:hHaCAor6b2eVjNtLT4nUrMP8Tm3Hft
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1032208316BC08375EAFF0B762C73955046BBBA44CA23CF6E19D0D11E4DA72480AA1F72
sha3_384: 2354c6c529c918d6e3628e89f7ad6611f2329b08f18f282e32585676362eb9049112c4df94ec8611e4736636f838cb9b
ep_bytes: ff250020001000000000000000000000
timestamp: 2063-11-14 18:00:40

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: ClassLibrary3.dll
LegalCopyright: Copyright ©  2023
LegalTrademarks: 
OriginalFilename: ClassLibrary3.dll
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

TrojanDownloader:MSIL/NjRAT.G!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Agent.Y!c
MicroWorld-eScan	Gen:Variant.Zusy.520631
FireEye	Gen:Variant.Zusy.520631
Skyhigh	RDN/Generic Downloader.x
McAfee	RDN/Generic Downloader.x
Cylance	unsafe
Zillya	Downloader.Agent.Win32.553307
Sangfor	Downloader.Msil.Zusy.Vtm2
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:MSIL/Generic.50f3cb23
K7GW	Trojan-Downloader ( 0058c6651 )
K7AntiVirus	Trojan-Downloader ( 0058c6651 )
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.PVQ
TrendMicro-HouseCall	TROJ_GEN.R002C0XLQ23
Kaspersky	HEUR:Trojan-Downloader.MSIL.Agent.gen
BitDefender	Gen:Variant.Zusy.520631
Avast	MSIL:Agent-CTT [Trj]
Tencent	Trojan.Win32.Bladabindi.16000442
Emsisoft	Gen:Variant.Zusy.520631 (B)
Google	Detected
F-Secure	Trojan.TR/Dldr.Agent.jykxm
VIPRE	Gen:Variant.Zusy.520631
TrendMicro	TROJ_GEN.R002C0XLQ23
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Varist	W32/MSIL_Dldr.D.gen!Eldorado
Avira	TR/Dldr.Agent.jykxm
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	TrojanDownloader:MSIL/NjRAT.G!MTB
Arcabit	Trojan.Zusy.D7F1B7
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.Agent.gen
GData	Gen:Variant.Zusy.520631
AhnLab-V3	Trojan/Win.Agent.C5543037
ALYac	Gen:Variant.Zusy.520631
MAX	malware (ai score=86)
Malwarebytes	Malware.AI.1828546589
Panda	Trj/Chgt.AD
Ikarus	Trojan-Downloader.MSIL.Agent
Fortinet	MSIL/Agent.PVQ!tr.dldr
AVG	MSIL:Agent-CTT [Trj]
DeepInstinct	MALICIOUS

How to remove TrojanDownloader:MSIL/NjRAT.G!MTB?

TrojanDownloader:MSIL/NjRAT.G!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X