msagent.sys is a signed Windows kernel-mode driver used by the latest CoolClient variant. It provides stealth by hiding processes, files, registry keys, and C2 network information. The driver is signed with a certificate from Nanjing Ranyi Technology Co., Ltd. and communicates with the user-mode backdoor via IOCTL requests.