Threat Database Trojans Trojan.Agent.MTGC

Trojan.Agent.MTGC

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 16,643
Threat Level: 80 % (High)
First Seen: October 10, 2026
Last Seen: October 25, 2026
OS(es) Affected: Windows

Trojan.Agent.MTGC is a malicious program classified under the broad "Agent" family of Windows Trojans. Despite masquerading as a harmless system utility, it is designed to infiltrate a computer quietly, perform damaging background activity, and open the door for additional threats. With a danger level rated 8 out of 10, this Trojan should be treated as a serious security risk rather than a minor nuisance.

What Trojan.Agent.MTGC Does

Once active on a system, Trojan.Agent.MTGC runs silently in the background, often disguising itself with file and product details that imitate a legitimate "support module" or system synchronization component. This kind of disguise is intended to help the file blend in with normal Windows processes so it avoids drawing attention from the user. Behind this false front, the Trojan can carry out a range of malicious functions, including giving remote attackers a way to gain control over the infected machine. Trojans of this type are commonly used to covertly delete files, install additional malware, steal sensitive data, or hand over broader access to cybercriminals. The sample associated with this threat also uses techniques linked to process manipulation and evasion, which can allow it to hide its activity from basic monitoring and make removal more difficult.

How It Usually Gets Onto Computers

Trojan.Agent.MTGC typically spreads by exploiting system vulnerabilities and security flaws that have not been patched. It is also commonly distributed through software downloads from malicious or compromised websites, as well as through email attachments sent from untrusted or unknown senders. These attachments may appear as seemingly ordinary files, such as executables disguised with extensions like .exe, .pif, .avi, or even image files like .jpg, tricking users into opening them. Once executed, the Trojan installs itself stealthily, often dropping a copy of itself into a hidden user folder to maintain persistence on the system.

Risks for the User

The presence of this Trojan on a system poses significant risks. Because it can grant attackers remote control, victims may face unauthorized access to personal files, financial information, passwords, and other sensitive data. The ability to silently delete files can result in data loss, while its capacity to install additional malware means a single infection can quickly turn into a much larger compromise involving ransomware, spyware, or other threats. Given its stealthy nature, the Trojan may operate undetected for extended periods, increasing the potential damage.

Signs of Infection

Because Trojans like this are built to run quietly, obvious warning signs are often limited. Users may notice unexplained slowdowns, unfamiliar processes running in the background, unexpected network activity, or new files appearing in system folders that they did not create. Security software flagging suspicious executables, especially ones with generic or vague descriptions like "support module," can also be an indicator worth investigating.

How to Stay Protected

To reduce the risk of infection, users should keep their operating system and all installed software fully updated, since unpatched vulnerabilities are a common entry point for this type of Trojan. Avoid downloading software from unofficial or suspicious websites, and never open email attachments from unknown or unexpected senders, even if the file names appear harmless. Using reputable, up-to-date security software to scan downloads and monitor system activity is strongly recommended. Regularly backing up important files also helps minimize damage if a system does become compromised.

Analysis Report

General information

Family Name: Trojan.Agent.MTGC
Signature status: No Signature

Known Samples

MD5: 9bbb769935c5b06adfb622d2271d62d2
SHA1: 88bd3ca95ee76049d8025ce428dab189e93e624c
SHA256: ACBAF3298BF4B85AEA1B47C1F00CBA7051D34FEF6AB98DCA830662578ECE9328
File Size: 4.04 MB, 4040192 bytes
MD5: f5288f70c636274054addbf4aa22c027
SHA1: 7690c08637ae99f44d38e19ee89a407b41d44011
SHA256: 675065A76E66C90D1C1E8EFCBE28ED2D9B9176AEE33247636A3E85D85EFE4F0A
File Size: 4.05 MB, 4045211 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show 2 more
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Comments
  • Session aid for application hosting.
  • Support module for device synchronization.
Company Name
  • Blue Mesa Systems
  • Maple Grove Soft
File Description
  • Host process support module
  • Task relay helper
File Version
  • 2.1.37.1937
  • 2.1.23.2046
Internal Name
  • Compat Layer
  • Task Relay
Legal Copyright
  • Copyright (C) 2021-2024 Blue Mesa Systems
  • Copyright (C) 2021-2025 Maple Grove Soft
Legal Trademarks
  • Confidential.
  • Licensed software.
Original Filename
  • Compat Layer.exe
  • Task Relay.exe
Private Build
  • 2.1.23 build 2046
  • 2.1.37 build 1937
Product Name
  • Compat Layer
  • Task Relay
Product Version
  • 2.1.37.1937
  • 2.1.23.2046
Special Build Release

File Traits

  • GetConsoleWindow
  • HighEntropy
  • x86

Block Information

Total Blocks: 1,566
Potentially Malicious Blocks: 231
Whitelisted Blocks: 1,335
Unknown Blocks: 0

Visual Map

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.MTGC

Files Modified

File Attributes
c:\users\user\appdata\local Synchronize,Write Attributes
c:\users\user\appdata\local\cversions_z2\imgcache.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\settingsync\udm3om.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\settingsync\vgi7uu.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ache-cag.tmp Generic Write,Read Attributes
c:\users\user\appdata\local\udm3om.exe Generic Write,Read Attributes
c:\users\user\appdata\local\udm3om.exe Synchronize,Write Attributes
Show 2 more
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\udm3om.lnk Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\udm3om.url Synchronize,Write Attributes

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n$ �v����Bx(�1`1�1HO@V�A��H[uN$_�zb"hk`k�q{b��P���!���� ���3�����������m�Ù��V����$�8წ���l��&M�~�=�SB1_T�Vw��R���%���������AE��D��&��$���LA*�"C�� RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\policies\explorer\run::1 "C:\Users\Wcyctuph\AppData\Local\udm3om.exe" RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\policies\explorer\run::udm3om "C:\Users\Wcyctuph\AppData\Local\udm3om.exe" RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �l! �v����#��(�1�1HO@V�A��H[uH�p_�zb"hk�ql(�{b��P��/�����������X����m�Ù��gi����$�8წ����j�&MA�=�SB1_B��T�Vw��R���%�������AE�zH��D��&��$���L RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries `$�!�:i��+00��� Gs]XM���"�2��FXD�':D��exA-��LG=�A��J� �C� RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix Cookie: RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix Visited: RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\applicationassociationtoasts::ms-availablenetworks_ms-availablenetworks RegNtPreCreateKey
HKCU\local settings\software\microsoft\windows\shell\muicache::c:\windows\system32\launchwinapp.exe.friendlyappname Launch Windows App RegNtPreCreateKey
Show 3 more
HKCU\local settings\software\microsoft\windows\shell\muicache::c:\windows\system32\launchwinapp.exe.applicationcompany Microsoft Corporation RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\shell extensions\cached::{f2506cd7-82c2-43d9-a1d3-f85f5efe7d09} {7f9185b0-cb92-43c5-80a9-92277a4f7b54} 0xffff 鱰䳃撄ǝ RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �l" �v����#��(�1�1HO@V�A��H[uH�p_�zb"hk�ql(�{b��P��/�����������X����Rc�m�Ù��gi����$�8წ����j�&MA�=�SB1_B��T�Vw��R���%�������AE�zH��D��&��$���L RegNtPreCreateKey

Windows API Usage

Category API
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
  • ShellExecute
User Data Access
  • GetComputerNameEx
  • GetUserName
Network Winsock2
  • WSAGetOverlappedResult
  • WSARecvFrom
  • WSASendTo
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
Network Winsock
  • bind
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • getsockname
  • setsockopt
  • socket
Network Info Queried
  • GetAdaptersAddresses

Shell Command Execution

C:\Users\Hvmxiicn\AppData\Local\Microsoft\Windows\SettingSync\vgi7uu.exe "C:\Users\Hvmxiicn\AppData\Local\Microsoft\Windows\SettingSync\vgi7uu.exe"
C:\Users\Wcyctuph\AppData\Local\Microsoft\Windows\SettingSync\udm3om.exe "C:\Users\Wcyctuph\AppData\Local\Microsoft\Windows\SettingSync\udm3om.exe"
C:\Users\Wcyctuph\AppData\Local\cversions_z2\imgcache.exe "C:\Users\Wcyctuph\AppData\Local\cversions_z2\imgcache.exe"
(NULL) ms-availablenetworks: