MSIL/Agent.FZ [Threat Name] go to Threat

MSIL/Agent.FZ [Threat Variant Name]

Category trojan,worm
Size 20992 B
Aliases Trojan.Win32.Jorik.Arcdoor.bmp (Kaspersky)
  Trojan:Win32/Malagent (Microsoft)
  MSIL:Agent-ABP (Avast)
Short description

The trojan serves as a backdoor. It can be controlled remotely.


When executed, the trojan copies itself into the following location:

  • %systemroot%\­svchost.exe

In order to be executed on every system start, the trojan sets the following Registry entries:

  • [HKEY_CURRENT_USER\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "Windows" = "%systemroot%\­svchost.exe"
  • [HKEY_LOCAL_MACHINE\­Software\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "Windows" = "%systemroot%\­svchost.exe"
  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows NT\­CurrentVersion\­Winlogon]
    • "Userinit" = "%originaldata%, %systemroot%\­svchost.exe"

The trojan quits immediately if it is run within a debugger.

The trojan quits immediately if any of the following applications is detected:

  • Sandboxie
Information stealing

MSIL/Agent.FZ is a trojan that steals sensitive information.

The trojan collects the following information:

  • operating system version
  • computer name
  • CPU information
  • language settings
  • volume serial number
  • FTP account information
  • login user names for certain applications/services
  • login passwords for certain applications/services

The following programs are affected:

  • FileZilla

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a URL address. The HTTP protocol is used.

It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • execute shell commands
  • open a specific URL address
  • update itself to a newer version

Trojan requires the Microsoft .NET Framework to run.

Please enable Javascript to ensure correct displaying of this content and refresh this page.