Trojan.MSIL.Agent.MOA

Trojan.MSIL.Agent.MOA is a Windows Trojan that the feed rates at danger level 8 out of 10. The "MSIL" part of the name points to a program built on the .NET platform. Trojans like this one pose as harmless software while carrying out hidden, harmful actions. The feed data lists only one detection, so the information available is limited. Where the data is silent, this article describes typical Trojan behavior and says so.

What the threat does

According to the feed, the Trojan runs silently in the background and performs malicious functions. It may give attackers complete control over an infected system, and it may covertly delete files, among other actions.

The analyzed sample has these characteristics:

• It is a 64-bit .NET GUI application. It is not packed and has no digital signature.
• Its version information presents it as "LXBASE" with the description "Just-In-Time FFI Gateway". This looks like a legitimate developer tool, which is a common disguise for malware.
• It contains references to the Rijndael encryption class and to the functions VirtualQueryEx and WriteProcessMemory. Code that writes into the memory of other processes is typical of malware that injects code or hides inside other programs.
• It uses privilege adjustment (AdjustTokenPrivileges) and keyboard or mouse hooking (SetWindowsHookEx). These are flagged as suspicious. Hooks of this kind are typically used to monitor user input, though the feed does not confirm that purpose here.
• It uses networking functions such as sockets and address lookups, so it can communicate over the network. The feed does not name any server.
• It runs a wmic command to read the command line of a running process. This is a way of gathering information about the system.
• It writes files named self_exe.dat in two user-profile locations: a Windows caches folder and a temporary "brightinfo" cache folder. This suggests it stores copies of itself or related data there.

How it usually gets onto computers

The feed says this Trojan installs itself stealthily. The usual routes are:

• Exploiting system vulnerabilities and security flaws.
• Software downloads from malicious websites.
• Email attachments from untrusted sources, usually .exe, .pif, .avi, or even .jpg files.

Attackers often disguise executable files as pictures or videos so that users open them without suspicion.

Risks for the user

With full remote control, an attacker could do many things. The feed confirms that files may be deleted. Typical Trojan activity also includes stealing passwords and personal data, installing other malware, and using the computer for further attacks. Because the sample can communicate over the network and monitor input, personal and financial information may be at risk. This is typical behavior for the category, not a confirmed finding for this sample.

Signs of infection

This type of Trojan is designed to stay hidden, so there may be no obvious symptoms. Possible warning signs include:

• An unfamiliar program or process called LXBASE, or one described as "Just-In-Time FFI Gateway".
• Unexpected self_exe.dat files in the user profile's caches or temporary folders.
• Unexplained network activity, slowdowns, or missing files.
• Unexpected command-line activity involving system tools.

How to stay protected

• Keep Windows and all your software updated to close the vulnerabilities attackers exploit.
• Do not open attachments from unknown senders, even ones that look like pictures or videos. Be careful with files that have unexpected extensions.
• Download software only from the official publisher's website.
• Use a reputable, up-to-date security tool and run a full system scan if you suspect an infection.
• Keep regular offline backups of important files so that deleted or damaged data can be restored.
• If you believe you are infected, disconnect from the internet, remove the threat with a full scan, and change your passwords from a clean device.