VHO:RemoteAdmin.MSIL.Agent (file analysis)

The VHO:RemoteAdmin.MSIL.Agent is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:RemoteAdmin.MSIL.Agent virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses suspicious command line tools or Windows utilities

How to determine VHO:RemoteAdmin.MSIL.Agent?


File Info:
name: DEB6F0DA92733A1D43C8.mlw
path: /opt/CAPEv2/storage/binaries/0cfd8e61512567ba85f0d3197d879e3f966fa84166980d46f80f6c1f7ddce1c1
crc32: 9EAB7747
md5: deb6f0da92733a1d43c8e859d236ad90
sha1: da22c829999548746a18fa1c4fae8edaaea87147
sha256: 0cfd8e61512567ba85f0d3197d879e3f966fa84166980d46f80f6c1f7ddce1c1
sha512: 1ce905e392d0f08f420ab296c4a412f176419870cee9e0d8cb54c7cd576325baa594d7811fd914242897ac09d0fafe92240ff8b7c6a13ffc40d6dda213881d3e
ssdeep: 12288:F2tXBcttttxtttOIeewsfpppppppppUpppppppHU33xtf0DRQ2tXxcttttxtttOk:EbLIusQUHirLIusQUH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DFA49F66EC55EEACCC2752773873C0919A627EB6B26469F713D5322B4C24C3180BB973
sha3_384: 66927e2ec55a734dcc281b56ccf70ce0c49e579d944075eff3fbe0b6b066fa305fdd38848699c4557ce7cd8e464ad438
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-03-18 04:29:07

Version Info:
Translation: 0x0000 0x04b0
CompanyName: Infinity Infoway Pvt. Ltd
FileDescription: Downloadable
FileVersion: 1.0.0.4
InternalName: DownloadITS.exe
LegalCopyright: Copyright © Infinity Infoway Pvt. Ltd 2011
OriginalFilename: DownloadITS.exe
ProductName: Download ITS
ProductVersion: 1.0.0.4
Assembly Version: 1.0.0.0

VHO:RemoteAdmin.MSIL.Agent also known as:

Lionic	Trojan.Win32.Ursu.4!c
Skyhigh	GenericRXCJ-QV!DEB6F0DA9273
McAfee	GenericRXCJ-QV!DEB6F0DA9273
Cylance	unsafe
CrowdStrike	win/malicious_confidence_60% (W)
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Trojan.Gen.MBT
Kaspersky	not-a-virus:VHO:RemoteAdmin.MSIL.Agent.gen
Avast	Win32:MalwareX-gen [Trj]
Sophos	Mal/Generic-S
Antiy-AVL	Trojan/Win32.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	not-a-virus:VHO:RemoteAdmin.MSIL.Agent.gen
AhnLab-V3	Malware/Win32.Generic.C4382419
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Zpevdo!8.F912 (CLOUD)
MaxSecure	Trojan.Malware.74693186.susgen
Fortinet	PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove VHO:RemoteAdmin.MSIL.Agent?

VHO:RemoteAdmin.MSIL.Agent removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X