Trojan.Kryptik.BDG
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| First Seen: | May 7, 2026 |
| Last Seen: | November 10, 2026 |
| OS(es) Affected: | Windows |
Trojan.Kryptik.BDG is a Trojan that targets Windows computers. It is rated 8 out of 10 for danger, so it should be treated as a serious threat. Like other Trojans, it pretends to be harmless or arrives hidden inside something else, then works quietly in the background without the user noticing.
Table of Contents
What the threat does
According to the available description, Kryptik.BDG installs itself stealthily and runs silently in the background while performing malicious functions. After installation, it may allow hackers to gain complete control over the infected system. It may also covertly delete files and install additional malware.
Technical data about the sample gives a few more details. The analyzed file is a 64-bit native Windows executable (not a .NET application) that runs as a GUI application. It has no version information, no resources, no digital signature and no security information. It also has an exports table and TLS information, and it was not packed. The signature status is listed as "No Signature". These traits describe one analyzed file and do not necessarily apply to every variant of the detection.
In the code-block analysis, 1,060 blocks were examined. Of those, 130 were flagged as potentially malicious, 919 were whitelisted and 11 were unknown.
How it usually gets onto computers
The feed data says Kryptik.BDG most often spreads in these ways:
- Exploiting system vulnerabilities and security flaws.
- Software downloads from malicious websites.
- Email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
Disguising a malicious program as a picture or video file is a common trick. Double extensions or misleading icons can make a dangerous file look harmless.
Risks for the user
If the Trojan gets full access to a system, the consequences can be severe. The description points to remote control by attackers, deleted files and additional malware being installed. Typically, when a Trojan gives attackers this level of access, the risks also include stolen passwords and personal data, unwanted changes to system settings and further infections. The feed does not confirm these specific outcomes for this detection, so treat them as typical behavior of the category.
Signs of infection
Because Kryptik.BDG is designed to run silently, there may be no obvious symptoms. The feed does not list specific symptoms, but Trojans of this type typically cause some of the following:
- Slower performance or unexplained high CPU or network activity.
- Files that go missing or change without explanation.
- Unfamiliar programs or processes that you did not install.
- Security settings that are disabled or altered.
- Unexpected pop-ups or browser changes.
The absence of these signs does not mean a system is clean.
How to stay protected
- Keep Windows and all installed software up to date, because this threat may exploit known flaws.
- Download software only from official, trusted sources and avoid unknown websites.
- Do not open attachments from unknown or untrusted senders, especially .exe or .pif files, or media files that behave strangely.
- Show file extensions in Windows so that disguised files are easier to spot.
- Use a reputable, up-to-date security tool to scan your computer regularly.
- Back up important files to an external drive or offline location.
If you suspect an infection, disconnect the computer from the internet and run a full system scan. Change important passwords from a different, clean device afterward, since an attacker with control of the system may have been able to see what you type.
Trojan.Kryptik.BDG has been seen between May and November 2026, with only a small number of detections recorded in the feed. A low detection count does not make it harmless, so careful habits remain the best defense.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.BDG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
962c36164fe194fcfeb8c5d0f17f8158
SHA1:
69cd15544b443e719cfcb3d4ffe7bf142b0cab27
SHA256:
E2E19384D0B949CA2F8C9C897E2A5B7A67A93E7A0E85A45CBB49387587120751
File Size:
306.69 KB, 306688 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show 2 more
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,060 |
|---|---|
| Potentially Malicious Blocks: | 130 |
| Whitelisted Blocks: | 919 |
| Unknown Blocks: | 11 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Trojan.Kryptik.Gen.EBP