Threat Database Trojans Trojan.MSIL.Agent.MOB

Trojan.MSIL.Agent.MOB

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 6,170
Threat Level: 80 % (High)
Infected Computers: 28
First Seen: June 13, 2026
Last Seen: September 23, 2026
OS(es) Affected: Windows

Trojan.MSIL.Agent.MOB is a malicious program classified as a Trojan horse that targets computers running the Windows operating system. Like other threats in the Trojan.MSIL.Agent family, it is written using the .NET framework (hence the "MSIL" designation, referring to Microsoft Intermediate Language) and is designed to install itself quietly on a victim's machine without any visible warning signs. Trojans of this kind are considered highly dangerous, as they typically operate in the background while carrying out harmful activities that can compromise both the security and privacy of the affected user.

What Trojan.MSIL.Agent.MOB Does

Once active on a system, Trojan.MSIL.Agent.MOB behaves in a manner typical of this threat category. It may quietly gain a foothold on the infected device and then perform a range of unwanted actions, such as collecting information stored on the computer, altering system or security settings, and allowing remote attackers to issue commands to the compromised machine. Many Trojans in this family are also capable of downloading and installing additional malicious components, which can further expand the scope of the infection. Because this is typical behavior for Trojans of this type rather than a confirmed, documented feature list for this exact variant, users should treat any system showing suspicious activity as potentially compromised.

How It Usually Gets Onto Computers

Trojans such as this one commonly spread through deceptive email attachments disguised as legitimate files, including documents, images, or executable programs with extensions like .exe, .pif, .avi, or .jpg. Cybercriminals often rely on social engineering tricks, such as fake invoices, shipping notifications, or urgent-sounding messages, to convince users to open the infected attachment. Infections can also occur through bundled downloads from untrustworthy websites, cracked software, fake updates, or malicious links shared through chat applications and social media. This is typical behavior for this category of threat.

Risks for the User

The presence of a Trojan like this on a system carries serious risks. Attackers may gain the ability to steal sensitive data such as login credentials, banking details, or personal files. The Trojan could also be used to monitor user activity, delete or corrupt files, and modify system configurations, potentially making the computer less stable or less secure. In some cases, infected machines may be enlisted into larger networks of compromised computers, used for further malicious operations without the owner's knowledge.

Signs of Infection

Because Trojans are built to operate stealthily, users may not notice obvious symptoms right away. However, possible warning signs include slower than usual system performance, unexpected crashes or freezes, unfamiliar processes running in Task Manager, changes to browser or system settings that were not made by the user, and unusual network activity. Any of these symptoms, especially appearing together, should prompt a thorough security check of the system.

How to Stay Protected

To reduce the risk of infection, users should avoid opening email attachments or clicking links from unknown or unexpected senders, even if the message appears urgent or legitimate. Downloading software only from official and trusted sources, keeping the operating system and installed applications updated, and being cautious with free or pirated software downloads can further lower exposure to threats like Trojan.MSIL.Agent.MOB. Regularly backing up important files and maintaining updated security software are also essential habits that help limit the damage a Trojan infection can cause.

Analysis Report

General information

Family Name: Trojan.MSIL.Agent.MOB
Signature status: No Signature

Known Samples

MD5: 320c0081dc62586276bd00a8f80aaa42
SHA1: 23b3a78530ae3e46da10806b43f34e58cc17f7a7
SHA256: 0F5AFEA5A0457806754A0C07E6990DE7A3620C20CBF6B36CDE3266107621B031
File Size: 5.63 KB, 5632 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version 0.0.0.0
File Version 0.0.0.0
Internal Name DeepHour.exe
Original Filename DeepHour.exe
Product Version 0.0.0.0

File Traits

  • .NET
  • x64

Block Information

Total Blocks: 4
Potentially Malicious Blocks: 2
Whitelisted Blocks: 2
Unknown Blocks: 0

Visual Map

x 0 x 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.Agent.MOB

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 㤆䯆ǝ RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcAcceptConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreatePort
  • ntdll.dll!NtAlpcOpenSenderProcess
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
Show More
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFindAtom
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenMutant
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtUnsubscribeWnfStateChange
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
User Data Access
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Anti Debug
  • IsDebuggerPresent