HEUR.Stealer.MSIL.Generic
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,416 |
| Threat Level: | 100 % (High) |
| Infected Computers: | 4,686 |
| First Seen: | July 23, 2019 |
| Last Seen: | April 4, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | HEUR.Stealer.MSIL.Generic |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
c369b9fcf82024ded30b7c12790872f6
SHA1:
abd6ee2a3099e40256aba489c5a6a39c73d39898
SHA256:
BF428802168CE48610A91F9ADF3F08D02F5FE51CE370C4F2762FDA5D34C60A83
File Size:
64.51 KB, 64512 bytes
|
|
MD5:
9b230780e7022de6bad5d27be8f129a6
SHA1:
8313ca35384052fd7c44304ea2339e82007cfe50
SHA256:
68E747133CA8304FB25F3FABCFD90F726375ADD6572C5FE571F515F7D2D357F6
File Size:
65.02 KB, 65024 bytes
|
|
MD5:
2f23da75bfbe05ba899b49e427eda626
SHA1:
6026acce9c47f6bbbde5d23132a2aa1a7138182b
SHA256:
F0A18CB5E44288B63114936EB290AE43CB4840B6D54D86637CFD514B02F833EC
File Size:
6.86 MB, 6863872 bytes
|
|
MD5:
4064ec81289b5dbf82772f8b81e9eda6
SHA1:
d9e9d8008ed47e377c8c8209029b9f94b9db9e06
SHA256:
66592877E123559DA6C15BFA1EC5645C99166870FA06EC67977D8183BCB2B082
File Size:
64.51 KB, 64512 bytes
|
|
MD5:
4087128f065e3429a964e4ccc1183c58
SHA1:
191d370ff84e7eaf503a0c3233853f65e7959e7f
SHA256:
8107CD1EA0E83865F0D14A8346DEE054D10F5361700627201226D1C662A14338
File Size:
64.51 KB, 64512 bytes
|
Show More
|
MD5:
65fa854c76580ba892a61ed4cd877e3e
SHA1:
d84cd77e889cfa99fda33a5953647b684a652772
SHA256:
F8F6352A5C726A00DEEDE0FE925C28F36A8F2696F18379F68B3254D697E22889
File Size:
64.51 KB, 64512 bytes
|
|
MD5:
f9630d275763760c167e2b411cd1cdd2
SHA1:
93aff6ec0fccbcbb0e0308b1ccb2b4975dc9b9f0
SHA256:
66B2170A8D4FDCA83EAB9C79599CAB63256E3BCD6CDFD76986093EA20B746FCE
File Size:
976.38 KB, 976384 bytes
|
|
MD5:
095b430e6231ca0992f938c8a77a8a13
SHA1:
5c619efa0e16e13e67211b40a22fd1891145c37e
SHA256:
11A5801E4ADDD72B2D007BA3F4A8CC77D53C0426F3A74D6BEBCBD34A3B76A2BA
File Size:
47.62 KB, 47616 bytes
|
|
MD5:
0f6653acc361c7e08adc4752d5cb10a0
SHA1:
3214e3d9eef5bb789edc1673e5a9b94cf5c0000a
SHA256:
AB44FA23EE0ABB174DD0370BC4C6713A19884012E6CAA1F2F0B07713C4C487C2
File Size:
64.51 KB, 64512 bytes
|
|
MD5:
d3fe8c9f36a7ce0f7fbdb31fe4866c70
SHA1:
73fe00e9bf4d6265bf78ab16c4bc8c916519e435
SHA256:
02B53AC14271A1E3CBD2C64E3CBF8935B08DCFC1CFEA25BF01162A4F2D92AAFD
File Size:
1.87 MB, 1868288 bytes
|
|
MD5:
d285698235dea8ae7e088919feedef11
SHA1:
c584ab38bbe377c84ac5d817b0820c6c84c629ca
SHA256:
C413D08829F1DA9E20E13C2E9BE797CF8447F1041F52C48F12124AD615EA3E8E
File Size:
273.92 KB, 273920 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments | KeePass 2.x plugin which imports credentials from various browsers. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 2+ executable sections
- Agile.net
- CreateThread
- CryptUnprotectData
- dll
- Fody
- HighEntropy
- No CryptProtectData
- ntdll
Show More
- RijndaelManaged
- Run
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 620 |
|---|---|
| Potentially Malicious Blocks: | 149 |
| Whitelisted Blocks: | 304 |
| Unknown Blocks: | 167 |
Visual Map
x
0
x
0
x
?
?
x
x
0
?
?
?
?
x
x
x
?
0
x
?
?
0
0
?
x
x
0
x
x
?
x
x
x
x
0
0
?
?
?
?
?
?
?
?
x
x
?
?
?
?
0
?
?
0
x
0
x
0
0
0
x
0
?
?
?
?
0
x
?
?
0
0
0
0
x
0
x
x
0
?
x
0
x
x
x
0
x
0
0
0
0
0
x
x
x
x
x
0
x
?
?
x
?
0
0
0
0
0
0
?
0
x
?
?
x
0
?
0
0
x
0
x
x
0
0
0
x
0
x
?
?
?
?
0
0
0
?
0
0
x
0
?
0
x
0
?
?
0
?
0
0
0
0
?
?
0
x
?
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
x
?
?
?
?
x
?
x
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
x
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
x
?
x
x
0
0
0
x
?
0
x
0
0
?
x
?
0
0
0
x
?
0
?
x
x
0
?
?
0
?
?
x
x
x
x
0
0
0
0
?
0
0
0
?
x
x
x
0
0
0
0
?
0
?
?
?
?
?
0
x
?
?
0
0
?
0
0
?
x
0
0
?
?
?
x
0
0
x
x
x
x
0
0
x
0
0
0
0
0
0
0
x
x
x
x
0
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
?
0
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
x
0
0
x
x
x
0
0
?
?
0
x
x
0
0
0
0
?
0
0
0
?
0
0
x
x
0
x
x
?
?
x
0
0
0
0
0
?
?
?
0
0
0
?
?
?
0
0
0
0
0
?
0
0
0
?
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
x
?
?
x
0
0
?
?
?
?
?
?
?
0
0
?
?
?
x
x
x
x
x
?
?
?
?
?
?
?
x
x
x
x
x
0
x
x
x
x
x
x
x
x
?
?
?
?
?
0
x
0
0
0
0
0
x
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
?
?
?
?
0
x
0
0
x
x
x
x
x
x
0
0
0
?
?
?
?
x
0
?
0
x
0
0
?
x
x
?
x
?
?
x
?
x
?
x
?
?
?
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\uwdcgzxjadvj.bat | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
44 additional items are not displayed above. |
| User Data Access |
|
| Anti Debug |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Other Suspicious |
|
| Encryption Used |
|
