Trojan.Kryptik.AAZF
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 8,228 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 5,576 |
| First Seen: | August 22, 2023 |
| Last Seen: | April 13, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Kryptik.AAZF |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9ea1c727ec62894e2a0a3ad482a00626
SHA1:
e58550caaa537addd6b1ef6b6cfd27d0ee1937f9
SHA256:
2B0B53D678585DD49D209CDAFD298BC1A352AA95D5ECD8CCFEA7810F4F16FB58
File Size:
2.26 MB, 2255856 bytes
|
|
MD5:
3ce82e63ba79a685f86d68fd3d4fb6e0
SHA1:
b98708a6478203cc72a3c443d941a9c91b093d55
SHA256:
B9DCC0C1A107C121EC4518733B35964315DA99DFB752C1AD59659F6A1AD42D09
File Size:
3.38 MB, 3375104 bytes
|
|
MD5:
91b4da222f84ae620bf09da2e975b524
SHA1:
36419277fc9e187390db722ace8cf8ce3dbc9502
SHA256:
EB168647C24D2CD40EFC24B32411D4EB6E86588531DE8D6CC4C9AB2A47954A97
File Size:
3.40 MB, 3395584 bytes
|
|
MD5:
94d2649285df98919f54ec9db83f726e
SHA1:
f8b7e803b2307accca5a570da1ea1686075ee1af
SHA256:
B032BB18A8A7CEF2F4D0C5BD4F6F44BC3A0CBFCC8A21B1159DC88F9A6024E378
File Size:
2.13 MB, 2129920 bytes
|
|
MD5:
65011afcc918d216e1ce346dfea8f51e
SHA1:
5e5d87b927d53aabc056ec405deb7e7d5dc8daed
SHA256:
8A15D2C035577BEE272422D53AECC9D6AD00AF72490B4B2F441AF12A5BBA579F
File Size:
2.58 MB, 2576384 bytes
|
Show More
|
MD5:
7ac3e4681848fb87fd3286a30a27526f
SHA1:
f13f361b22ad02e3e9e20ee9714d3273e601d93b
SHA256:
44786769AE4D9B0993B1CFC46C9E729E471DD785C53C79A7F75B2D0569F2ABE3
File Size:
2.23 MB, 2229231 bytes
|
|
MD5:
d06ce329b54418849b1e5423fba20109
SHA1:
aa8f51493850c572e9b210fd8f1362664e192474
SHA256:
356D83BBDC46A0EEC222D7A553EF3803244334E6E09454B2919890DEB39E19D3
File Size:
5.62 MB, 5620224 bytes
|
|
MD5:
c91e72769d5cc7f145ea5ffebc69a3da
SHA1:
f2620c0a947eee7f39d148c2ccf6d2a4d8aa791f
SHA256:
6EBE0E5BC6223F03D23A74FFEE0D94EB0E95F728DD461B4324DA73E486314F59
File Size:
1.93 MB, 1929216 bytes
|
|
MD5:
fa3acee055e72a0a99e0ae2c7fea8f2b
SHA1:
ccce3f2727c21c987b6cddad0cecbcdb4c823a20
SHA256:
2C7A23A9852960E8A52DAFE4C3FCBD132435BA43E19A0A5137265C68F1462EEA
File Size:
3.97 MB, 3973120 bytes
|
|
MD5:
5d5b36d49bde91dcd86e3a9eccfb07e5
SHA1:
977936bf2ba41f29e0746316a33e75c6c26db757
SHA256:
D682CF51164E300C650710AE762D49ABDF033A93AD2F39B8703ECC912E458AB9
File Size:
2.06 MB, 2057626 bytes
|
|
MD5:
065d7e95bedd4f76e7ff7e6a54c8a10f
SHA1:
3f842dd978dfa3f300f4b9c73f8ad74522e5bd47
SHA256:
2F9547D1E9D14E4F498FBCFB1F832708A5071C66A2186D996F22395F645416B3
File Size:
4.74 MB, 4743168 bytes
|
|
MD5:
340521df671998264d929d6b3224b504
SHA1:
11c3eb8a8b7c9fe0e54bf5f74dd6b7bb1d18986e
SHA256:
8D3E9B6C861E05AEB77699CCC21AE95397E2CA5BF4244C2EFF409ECAFA1CE754
File Size:
2.61 MB, 2613248 bytes
|
|
MD5:
aa98b4d2811b173a2c35a455ce7451d8
SHA1:
282fd2435e74535bbb6c64d9b06a9bb8e61b07e0
SHA256:
D2D9397E75F42F050CE252477F62AF6E2BDB6E859BBB8909373EDC1A44CA7389
File Size:
2.54 MB, 2539520 bytes
|
|
MD5:
e3826557138f9223e572a1f1a6e4cfcc
SHA1:
a54a0342cf891d90b5cf7966702f73de207a2135
SHA256:
3B52E7E9F857952DFC3107FB084E6009742B008CFE44E2723E7F47F9F8A1557A
File Size:
6.60 MB, 6598656 bytes
|
|
MD5:
12f353653149556bd930c3fa78c3685b
SHA1:
de2a1c17be72204837bd577ab6d0a48b40618c90
SHA256:
0246AA2C10BD026B98D9BDB7095854A158AD98E4707DC69FADCCEE55F0F48A62
File Size:
5.90 MB, 5902336 bytes
|
|
MD5:
7c1d29ad278a82af5b40eab47929e66e
SHA1:
eb1985c04cc9f3094bf2826af7b868794c490b62
SHA256:
1B20767B50A7B21FB35A86C92557B5C3F0D26CBF8511C3FDC98FB4B48B11FD35
File Size:
6.06 MB, 6061493 bytes
|
|
MD5:
263fcff6c130a607cf6316716de6b6fb
SHA1:
7974f5e9cb366d5cf8a15e9b237ff2cad0cdc054
SHA256:
E500C0650D0E1213F976D26FE4BDED851551FC5D00E87592CEA7FCB3EFB56D55
File Size:
5.81 MB, 5812224 bytes
|
|
MD5:
2c7e9c2651d904ad7a3b8d4737dfe80a
SHA1:
33b3cf335a0c825b5f2325a5bffdfb029411f03d
SHA256:
93F4D9678008236A534CB7893594C8914756E22A5EA95DBB39024A13146DBFC4
File Size:
6.20 MB, 6201344 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| 00.0 | D |
| Assembly Version | 0.041.. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Full Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original File Name | HD-Sensor-Native.dll |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
| Froduct Version | 70.0.00001.0 |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| The Qt Company Oy | DigiCert SHA2 Assured ID Code Signing CA | Hash Mismatch |
File Traits
- 2+ executable sections
- dll
- HighEntropy
- imgui
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 39 |
|---|---|
| Potentially Malicious Blocks: | 8 |
| Whitelisted Blocks: | 5 |
| Unknown Blocks: | 26 |
Visual Map
?
x
?
?
?
x
0
?
?
0
x
?
?
?
?
?
?
?
?
?
?
?
x
?
x
?
0
?
x
x
?
0
?
x
?
?
?
0
?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Autoit
- Delf.Q
- Kryptik.AAZF
- Philadelphia.A
- Philadelphia.B
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\autbef0.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\windowsloader.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\windowsloader.exe | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| User Data Access |
|
| Keyboard Access |
|
| Network Winsock2 |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e58550caaa537addd6b1ef6b6cfd27d0ee1937f9_0002255856.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b98708a6478203cc72a3c443d941a9c91b093d55_0003375104.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\36419277fc9e187390db722ace8cf8ce3dbc9502_0003395584.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f8b7e803b2307accca5a570da1ea1686075ee1af_0002129920.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5e5d87b927d53aabc056ec405deb7e7d5dc8daed_0002576384.,LiQMAxHB
|
Show More
C:\Users\Rhcnwlwn\AppData\Local\Temp\WindowsLoader.exe
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f2620c0a947eee7f39d148c2ccf6d2a4d8aa791f_0001929216.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ccce3f2727c21c987b6cddad0cecbcdb4c823a20_0003973120.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3f842dd978dfa3f300f4b9c73f8ad74522e5bd47_0004743168.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\11c3eb8a8b7c9fe0e54bf5f74dd6b7bb1d18986e_0002613248.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\282fd2435e74535bbb6c64d9b06a9bb8e61b07e0_0002539520.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a54a0342cf891d90b5cf7966702f73de207a2135_0006598656.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\de2a1c17be72204837bd577ab6d0a48b40618c90_0005902336.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7974f5e9cb366d5cf8a15e9b237ff2cad0cdc054_0005812224.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\33b3cf335a0c825b5f2325a5bffdfb029411f03d_0006201344.,LiQMAxHB
|
