Trojan.MSIL.Agent.IAC
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,534 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 462 |
| First Seen: | January 6, 2025 |
| Last Seen: | July 20, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.MSIL.Agent.IAC on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malicious software, commonly known as a Trojan, which can compromise the security and integrity of your computer. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is Trojan.MSIL.Agent.IAC?
Trojan.MSIL.Agent.IAC is a type of malware that can infect a computer without the user's knowledge or consent. The term "Trojan" refers to a broad category of malicious software that can disguise itself as legitimate programs or files, allowing it to bypass security measures and gain unauthorized access to a system. The ".MSIL" part of the name suggests that this malware is written in Microsoft Intermediate Language, which is a programming language used by the .NET Framework. The ".Agent.IAC" part of the name may indicate that this malware is designed to operate as a stealthy agent, potentially allowing it to communicate with command and control servers or exfiltrate sensitive data.
How Trojan.MSIL.Agent.IAC Operates
Once installed on a system, Trojan.MSIL.Agent.IAC can operate in various ways, depending on its intended purpose. It may attempt to communicate with remote servers to receive instructions or transmit stolen data. It can also try to evade detection by disguising itself as a legitimate process or file, making it challenging to identify and remove. In some cases, this malware may exploit vulnerabilities in software or operating systems to spread to other parts of the network or gain elevated privileges.
Symptoms of Infection
Infected systems may exhibit a range of symptoms, including slow performance, frequent crashes, or unexpected behavior. Users may notice unusual network activity, such as unfamiliar programs or services connecting to the internet. In some cases, the malware may attempt to display fake alerts or warnings, trying to trick the user into installing additional malware or revealing sensitive information. However, some infections may not display any noticeable symptoms, making it essential to rely on regular security scans and monitoring to detect potential threats.
How to Remove Trojan.MSIL.Agent.IAC
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any associated malware or infected files.
- Uninstall any suspicious programs or applications that may be related to the infection, as they may be acting as a conduit for the malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings that may have been altered by the malware.
- Reboot your computer and perform another scan with your anti-malware tool to ensure that all associated malware has been removed.
Conclusion
Removing Trojan.MSIL.Agent.IAC from your system requires a combination of technical knowledge and the right tools. By following the steps outlined above and maintaining good security practices, such as regularly updating your operating system and software, using strong passwords, and avoiding suspicious downloads, you can reduce the risk of infection and protect your computer from potential threats. Remember to stay vigilant and monitor your system for any signs of malware activity, as the ever-evolving nature of cyber threats demands ongoing attention and proactive measures to ensure your digital security.
Analysis Report
General information
| Family Name: | Trojan.MSIL.Agent.IAC |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
dba1166d103f2908ee03bed6e245a5b4
SHA1:
8501a9368041c09401e66a21a495b7f5ce9215f7
SHA256:
5183DC1BA9F210B7E8991C234F008D676DB457B2D273480A7771DA114AF569B5
File Size:
2.93 MB, 2926881 bytes
|
|
MD5:
0a6699331bcdeda5483ca13bc102a3af
SHA1:
7932266007680352bd569b147ef9f4d7fb27e399
SHA256:
04DB041A08841FEB7C42B5B7C62CF33793F992A27F5465B9BC98E8A4AAEAD09F
File Size:
196.13 KB, 196128 bytes
|
|
MD5:
444c21729858b4d37aac36eb9598de7f
SHA1:
390ac83a495800c5d0ff6af610c9bb9bb27bb8a2
SHA256:
7819CEFA8D1E056AAB001703BBE11A6106A34FD75BBE1FB507EC6E7D43C85B78
File Size:
2.93 MB, 2926840 bytes
|
|
MD5:
a262c5499f299152ab5b09274a932d8b
SHA1:
3815bcdcfb5ff56768c1e7f328f3743cbaca3632
SHA256:
B98D2DA5292AA463CD530478909C7F1D1963AC2E6524A0DE097B56D535DCE963
File Size:
1.58 MB, 1581600 bytes
|
|
MD5:
4c32a7fa7be3f451c91268cfc3b0b3c2
SHA1:
cb3b1cbc0bc21b0f1195efbe46d7c1d2c9b87b52
SHA256:
A14313337370B4B6E789CB23C5C767D04ADCE5973B0D9C3BF13210E75BAF1AD4
File Size:
536.58 KB, 536576 bytes
|
Show More
|
MD5:
b55ff58e34d3be2d0249abeb713c2916
SHA1:
405fe2a6b499b9219be9124674709b0e631b0a39
SHA256:
F3C89F5D6415A89CF4C90C1EFA006BAA265F6DFD5250EB02028CF08579E11EBB
File Size:
52.22 KB, 52224 bytes
|
|
MD5:
9354249fa99c85c1bd91be6068d29c2b
SHA1:
b23ef628f62896f613acc48e8ac85562b6b39f8d
SHA256:
C3123260EA70F560F9662B7B39444ACD7AA6BE4650464111814FC1D05CE23DB6
File Size:
5.67 MB, 5671127 bytes
|
|
MD5:
927148507cde6b2634f9fe4221248002
SHA1:
b2bca28d1941a39b3ab452d6fff236ee65209c67
SHA256:
A22A9B1C922A1ABDAD659540A559EB28DECE249A03A21C00D54D9EB52AFB60D6
File Size:
2.93 MB, 2926895 bytes
|
|
MD5:
2642a92b74e71fe979d1459a711de71a
SHA1:
a8029384283e869a62295452801cdc8ff8e0fa7d
SHA256:
1A5EDB34F750B8877E74B4DED0AD5D826ACEC1A8B1D0903237062015E4E8D8A1
File Size:
857.12 KB, 857120 bytes
|
|
MD5:
67b6107e965a64a1102125d55d970826
SHA1:
78bd3f2998c4a475d4c6518c89fe068e1a7c3874
SHA256:
1EA4D941F3BB699AC4B7DFCED27E31DDCD68C907AC1EA2C26AE2F0BE13777038
File Size:
5.02 MB, 5022208 bytes
|
|
MD5:
56750fffd6bd41f6810fb97dff58fa53
SHA1:
3aaf811ee55cd2e4a8b74aa9dae42f3f87bb3f11
SHA256:
4382E427DAC78948FA973035320DDE5BFCB58CB835DDA3932E5F41C593BFF9FD
File Size:
1.58 MB, 1575456 bytes
|
|
MD5:
7e6ba3a03c32b66dae8194c79ef41dd8
SHA1:
b3f17499097ee8dbf1cf74b55996a69fc15b22d1
SHA256:
FFA6A3F4BF9A26BB056D964174A1ED58D9DD608108169F8B2BF9F97E1162572A
File Size:
3.23 MB, 3229696 bytes
|
|
MD5:
8c73cad2180515eec02223ac4fecfb58
SHA1:
193b0e5f03225f00b2fdf776a89dedf454aa4fa9
SHA256:
8468ED427E45CD4AD870292670C07700F9746DF86BC8D15A79ADDE2BD13DE1E5
File Size:
3.13 MB, 3131392 bytes
|
|
MD5:
e8ebcba25093e478c032a7f90e52e244
SHA1:
f2a313ff8836f5a0faaedfbc226a4fe4020a05e2
SHA256:
9B1A5FF9EC94F8540ECC5C7D31E2EC8E536E209D00BEBCCE3732414168E9D7A0
File Size:
2.93 MB, 2926896 bytes
|
|
MD5:
5f55703b5c4c5189db549dafccf948be
SHA1:
faecffd2c7c82916bef6b8c033c1b13e888aa997
SHA256:
A4C5B7E2193458EBE9B1781D612D385D571A4D4A9D5039BF40B8D926E82B04FD
File Size:
2.93 MB, 2926693 bytes
|
|
MD5:
242808b2aec42418ead324e123ea4b2d
SHA1:
002d3cbab6538af620874c3ec160a9649c275762
SHA256:
DCF1474E97360EAC3A7E37FFB6FB56856C2F870CA6E9CAFFFAD7B0D48400327D
File Size:
2.93 MB, 2926745 bytes
|
|
MD5:
0e2614b752a06f0e58cdd7246ae07ca6
SHA1:
ad9607b95d8ab3e0afbf157d98c9963fe7001d68
SHA256:
BF98543473C76AF5BA232597034E4D897B9BE0BF4811F4AA98AB529F388575B4
File Size:
3.69 MB, 3687456 bytes
|
|
MD5:
55f4d7aa801aa0303ee3d2f6d0e65832
SHA1:
63ac890e69cd9d507e29c54a17426a33bea9ea0f
SHA256:
824CCD87570F348A425A4950A526DD8E8A7769AA8618EF68B0F2B94A5C39FCA4
File Size:
530.43 KB, 530432 bytes
|
|
MD5:
6bb5c6e65666c31e83167f4439d215a1
SHA1:
0554ccdd2b8ddcee6374c52b335af111f44c875f
SHA256:
7255498750055667CD9C32222E0D626953E2CDCCAF22DC9C0047E8A8E3327B08
File Size:
2.93 MB, 2926806 bytes
|
|
MD5:
1ed783669fb1623ce8256e1c46f702d5
SHA1:
8e349da08fb6b95fd609a2497970532ca08d6b21
SHA256:
9EDEA229D7FE59B31978785BEFE3726AAB6FE9923C82C7326F4AA78DE68AF86F
File Size:
2.93 MB, 2926660 bytes
|
|
MD5:
f9db5389c6acdb3ae9d6b214744cd48d
SHA1:
5d439843d280f7c65967d748025df8e549e9eed3
SHA256:
4F961F4BB326334E71EB550B3BD427CD5D2A36B7CBCBE6C2E80AB7D39B3F4361
File Size:
1.55 MB, 1550880 bytes
|
|
MD5:
134ac3ea7027186a9df4f4793b17d1e2
SHA1:
14e4ce380580d6f688b1337779cd6e65ad4f6c64
SHA256:
7251C926F493E8613FC7CB8B4F027F82A3D1E8E5ED6BDC2BC39A612264B98FC3
File Size:
1.56 MB, 1563136 bytes
|
|
MD5:
7fa2a561a220af46a3a21ba0e3153a3f
SHA1:
6d8e62cbfb97e11dfafb4cdbacf200bfa03962f3
SHA256:
FB5830D7683CD175E169A17A509E73F76F4EEE4AB026D6C052E94DF4050869B8
File Size:
2.93 MB, 2926846 bytes
|
|
MD5:
9ea2604a4e4c73656abdfafda530545f
SHA1:
73b89f1f67d92251981ac832885c0ef316f6cc18
SHA256:
1A55CD4C0FE1650ADA6C044801E7D710296308C7CBEBF6ED5F68695DA37AA0C2
File Size:
2.07 MB, 2065920 bytes
|
|
MD5:
181bddaaf9314fb7b02dcaf76a3364d8
SHA1:
fd135ce3361aa00a8c7173cf635011ff6380e88b
SHA256:
B37E574DE6B844D10FABEBC457A266BC0E13C88B2D42F68F980EDC9776873EC4
File Size:
2.93 MB, 2926744 bytes
|
|
MD5:
a817a70f27a133554c404eb7525128c7
SHA1:
5dd82bb70a9446f8eefb47a48166354ed7a8ffc6
SHA256:
A98894C2EEAFE797F5E25EEF677A269F0BD6DB2A1D25975C636E99AD51C02A3D
File Size:
6.31 MB, 6314016 bytes
|
|
MD5:
298b92bfd42bb6d11dc08c515f60e647
SHA1:
0164b1c75691007ba5b2c5426dc6549e5a5024bb
SHA256:
C643742DC85B8B45B78B8C673618C65031683E893FAA717B114D146FCA4FE9D7
File Size:
1.81 MB, 1807360 bytes
|
|
MD5:
af51089f20246393a2b809c81977e059
SHA1:
9186b0090e7670f395889f7237a90fa44089bbdc
SHA256:
A019FF4F252B53171661ED0A7E39C7FDEB6AB188CB32E635B4001AC04C459057
File Size:
2.16 MB, 2159136 bytes
|
|
MD5:
d35dab54b63614b1a3fc9770660f4340
SHA1:
0ef93e6d5f7a428aefe0b461263f51aeaadd1543
SHA256:
2046FD7D2E0E110EB602CFD7C2E3F74EC5C5F8BF4228E9656AE0A19189F227B5
File Size:
2.93 MB, 2926803 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Legal Trademarks | BejoIjo Corporation |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
|
File Traits
- .NET
- 00 section
- 2+ executable sections
- Agile.net
- CreateThread
- dll
- Fody
- Goliath
- HighEntropy
- NewLateBinding
Show More
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Agent.IAC
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\downloads\commando.exe | Generic Write,Read Attributes |
| c:\users\user\downloads\commando.exe | Synchronize,Write Attributes |
| c:\windows\appcompat\programs\amcache.hve | Read Data,Read Control,Write Data |
| c:\windows\appcompat\programs\amcache.hve | Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\software\microsoft\tip\aggregateresults::data | 隞̃錁耀꧌ g | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
| Syscall Use |
Show More
19 additional items are not displayed above. |
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Network Info Queried |
|
| Network Winsock2 |
|
| Network Winsock |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 752
|
