Trojan.Kryptik.Gen.DBQ
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 2,519 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 103 |
| First Seen: | February 10, 2026 |
| Last Seen: | June 5, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Kryptik.Gen.DBQ |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
b054cb025c67eb1e27b984f52a191917
SHA1:
0e95e6d574b84da4473dc2cbe39cf46f9b03e0fa
SHA256:
02FF23A4D5CA9E19B1D6D34BF05E26E1E52834D49C9B342049331D6C161484F4
File Size:
605.92 KB, 605918 bytes
|
|
MD5:
451beaf87986ef52605d3a99bd7a6b23
SHA1:
7c991dc2ab2ee41bb0084ec79a8d31fad2fd7d1d
SHA256:
331E592CF7FABAE31508D6EFD7CF9D2F3458F10085BEFA8D59E8A3993EA80E43
File Size:
2.73 MB, 2734937 bytes
|
|
MD5:
250ad250af353f31b6c662bd671f2783
SHA1:
548a8defbaf1e3474fa3db69c7268294f6d8895f
SHA256:
54FF42709F0D9FC94F65FE8D7F1288587966DABAE136F9D5C6EC3ED3E9834D34
File Size:
1.81 MB, 1814928 bytes
|
|
MD5:
87a87134832dc6bd910a2fdf92ed3a73
SHA1:
0d40f7f81b57243850066185b788242974455536
SHA256:
13D2B6D339946665271581A8D8FED954535F6B3405FB82BBB5614491F7A25DB4
File Size:
1.61 MB, 1614760 bytes
|
|
MD5:
d833ddd42217849d90418f18e406168b
SHA1:
86b175502337a5a8f5bca48091f5ad6e03b2939a
SHA256:
B877F3EF3A5F6941AB8A732CAEAF21FA80A8818814382AA3EC49FD9A6128B45B
File Size:
1.82 MB, 1816484 bytes
|
Show More
|
MD5:
285292d86f774302853af0e93a2353c2
SHA1:
2af7161fd492aae8ebc41945a1fa9004960cf0ec
SHA256:
52EDDCFE0DD3093B6D66CEBBD420480846E0AC79C422D88137A1A96AA34FE894
File Size:
1.59 MB, 1593032 bytes
|
|
MD5:
cac62732830cf65e8578a50a3fc1114b
SHA1:
1c8eb481822afc8dcb7c84b39ed07d08d5eac737
SHA256:
FB209B43468810B910846E2520E98DFF84074F60C038362C61A1FD5E92B81834
File Size:
3.41 MB, 3412072 bytes
|
|
MD5:
431fd1c2e9e89b58e66ad3ec449f25b8
SHA1:
0afb05de7a6f402605f3dbf8ca5c9a6a378c0e95
SHA256:
BBFE9320BC5247DF59E1FB651428D2CA9E5A90105D4473DE73E75CD0A56BE5AC
File Size:
3.40 MB, 3403540 bytes
|
|
MD5:
8d91a5287d842fc54a20b43abe4f42cd
SHA1:
f9c01a81c780f1d3a9c33925235ef2f5735c2b11
SHA256:
C140527D5665214300EBD20CF46CA1F9DA97303971204B01A9A22784F6D662AE
File Size:
1.12 MB, 1115720 bytes
|
|
MD5:
805d16ce8bd7bc6a0eb05cfc9d933f20
SHA1:
a1b9d4a5e5f402f8c9ee41c0f30181b902dcdb5f
SHA256:
E25613EDC204FEC0E3B94D942D003A0EEB656DC365664AE5E377A721416598F7
File Size:
1.10 MB, 1100728 bytes
|
|
MD5:
d3e92da9c7fb8fa6c5c23fd8fdc73872
SHA1:
630de320379240f4a4f0382fb55e21d85c2e53ef
SHA256:
CB199DB146FB7FD5B31C7B2C05F29E163EE807DE60CCAA517F5DC5DDF6B37093
File Size:
1.08 MB, 1084000 bytes
|
|
MD5:
0f1d74715336395ab592576d66df7003
SHA1:
cacf1bf6b1d494d849dfdad1a1cd9b99b9b56705
SHA256:
8276E230DABEC99FDC6AD74F56E09196A0B5B454459A76F7B6FEE24BC7928294
File Size:
1.08 MB, 1078920 bytes
|
|
MD5:
448788199244eb82b8eb561094fc3e35
SHA1:
ff34f7f0769db10347776208df06718b9bdb3765
SHA256:
0625D020AE31CA641D5C5968ED0D36C5ABA6474DC70C57237D84046C7A8001A3
File Size:
1.08 MB, 1084520 bytes
|
|
MD5:
73ef1432675addd0cb60676672e34da9
SHA1:
8c2d7c45ad02186e9dda43e1cd88b79ab132a549
SHA256:
7962A5EE5F758C36B5B9095F26681D64C068C06A8A0A67E47A7BC8E2DA5769A8
File Size:
1.08 MB, 1083572 bytes
|
|
MD5:
02f2aab7072018656093074b754278bf
SHA1:
1d30452028a111831dc361d363f56c060188e4b2
SHA256:
EFDB7108BCBBD9D5D930A006AAA75A256D147D51A2D6DDBCE84D74525F617D7E
File Size:
1.11 MB, 1109744 bytes
|
|
MD5:
d06c23047c0da2dadf2a10ef36d27047
SHA1:
60e4444fdb9d32abcdc54f0e5355bd7e45db02c9
SHA256:
73FF03B2B1B39AB61D33024E5727546FF3B10204431C7B930565C025C3937247
File Size:
1.10 MB, 1101572 bytes
|
|
MD5:
07c2cbda2f819a716908b32e770408d6
SHA1:
5ee7d48a24cdb1db6277f545db8bb3ec27e2015c
SHA256:
C37FA714409625C264773F135B84F251F3963A1EA1DFA5C2A2729EBC7DD5D3C3
File Size:
1.14 MB, 1135108 bytes
|
|
MD5:
50390b94cd5a9bc02b0389a9fead6ce0
SHA1:
6524af1cfa99cb211bc10e0dc30eb22603ed1b4e
SHA256:
8DD93DBD95CE01A350539803C95C41742F7441F79FFC19632409D56CCFB1E4B0
File Size:
1.10 MB, 1095728 bytes
|
|
MD5:
4e213d2e21e768579d33645738c2c19f
SHA1:
daf638b0b8354d73a1ae7677089d0ae069a0dd8d
SHA256:
CA2EB8AC848E36E50DC6B489D2CECAAE28F872B4C2540A3DF512783846746C7D
File Size:
1.10 MB, 1103160 bytes
|
|
MD5:
cefcb24ea7d0ec18ce00336d46814e97
SHA1:
7dfaee6044944e38061f9998433f8a4f2878b6a8
SHA256:
C907D5F498820D3834859761510FB4D944E304EDD9AB1F36BB96660E6FDE4B41
File Size:
1.09 MB, 1094456 bytes
|
|
MD5:
e30b7d9e68a4178e09389862711d8bf1
SHA1:
7def1cc1e511c2c77141a15a1acb01ffdc271bbe
SHA256:
E9A2437966DB6B80E3335DD221C7085680156862CF88F5C925D3EEDFC2A1A13F
File Size:
1.08 MB, 1082896 bytes
|
|
MD5:
a19bb6fa182732330e4389da11abe1de
SHA1:
63d05ca277e92a6dd8a93cbb6697cf184aa86c54
SHA256:
79545BDEF9DA3EB4AE5D8EAC2E83FF7524B94721E222BEA55CC7807EBB7F31C7
File Size:
1.08 MB, 1078732 bytes
|
|
MD5:
ba39a86173dc9b4d9799f534240d5ae0
SHA1:
31e288a7b8f1cd7acdfea3af6697f57535bce5dc
SHA256:
F13CC4E5DABDBA57BA2B2E6A6112B51B5DEA0847918A93B09993AE433720447E
File Size:
1.09 MB, 1091088 bytes
|
|
MD5:
34b656147ad037217212a45ce7c4164a
SHA1:
94f184b00da73f4b27814824305f086cc11787fc
SHA256:
E927D844BA1D0601879E5F1818FDDAE6CD20C89699DD21428F93BF3D7DCAD8EB
File Size:
1.13 MB, 1131108 bytes
|
|
MD5:
2918a3fb943b0f0a91d399efb0dd15f5
SHA1:
dde82f0d1329e719d2b978d00283e53425aa567e
SHA256:
8FC870F99354D3A6D3814CAB0F6326C347CECE51FB69BC2F66A7CA646432FA66
File Size:
1.10 MB, 1095256 bytes
|
|
MD5:
24b31ea6e9c165c3a96c08e6827d3bee
SHA1:
f1e4085ebfc4245bffb8c4e8174b775394b7e05e
SHA256:
677F3B5309BE5AE4FB87D3EFACD66F28F710DB5B591F00B432BBF6F6A71092CB
File Size:
1.13 MB, 1127488 bytes
|
|
MD5:
9ef3911531b238b3705b7fe686be0848
SHA1:
fe82005b91e84acaa1df1f92d405556358250cbc
SHA256:
8F3344FEFDFF2AB67E11661D7CA8B2C2DC4FCDCE1271A2465C504473914AA479
File Size:
1.14 MB, 1141400 bytes
|
|
MD5:
04b917332b3fc7726998f8eef1f5cdaf
SHA1:
dd6c9f96e6b9a7f515508188ab8e9842d41267a3
SHA256:
A402EB073ADB6EED6AEC337B65CB279A281FC97ADC8BC4E7C8A1FAE69814F7C4
File Size:
1.10 MB, 1101276 bytes
|
|
MD5:
758fc46e81b1c4a319e05031463a5b86
SHA1:
739f51ecf58d587b861b6b4ea8f1f09d132654e5
SHA256:
083B267E25CBB1FD82205751D73BAFE1A054F12632D101C4251A7B0B7AE4352E
File Size:
1.12 MB, 1115640 bytes
|
|
MD5:
c0b39c609de91d427a82b88010cecf08
SHA1:
8e2e537a10a85a3e531aecf612af81444cfa3bee
SHA256:
F95B6C5952B1E4478AF42192CAF01107717F93ECC11316A5FFCCC12254D18AC6
File Size:
1.14 MB, 1136552 bytes
|
|
MD5:
ccbc38a1c1370356958eeb0b8db102be
SHA1:
50e09d049d96ba0857adf6ef4386314bc7422778
SHA256:
17849A20DA1A0A853F1407AACD79753E7C8D6EE55384FD51685B5D601ABEEE93
File Size:
1.17 MB, 1172520 bytes
|
|
MD5:
98823def383f6e9f6d790260f3a02ffd
SHA1:
e39f73c9126aa537c6818501ae8ed1c978d11fa5
SHA256:
27FD17EF0E6FE9D2E022AF29C9C45479480C6931D6CE2893D22019C549C67B85
File Size:
1.13 MB, 1134536 bytes
|
|
MD5:
6006ac0a49d1dbc36b219329dcc2b4f2
SHA1:
2f3d6f887d2f2aeadf23a177c63802db873d1dce
SHA256:
9F114267DE98514C530686EC0091B189D51C50EF43E74C2FC98152F216D3E576
File Size:
1.12 MB, 1116876 bytes
|
|
MD5:
d0ca6d70596a112dd24df8c95e8bd500
SHA1:
57b17a5bf0fe816fd97041709edecf7c8c486b29
SHA256:
3A0676CF60E692E3B73BA0812897CEC864B51E5FE6DA4D446A7FE890AC6A8F49
File Size:
1.16 MB, 1159996 bytes
|
|
MD5:
d66013019d5f58bd8e381364f85d8cbf
SHA1:
efb02816239d70386c9d5e4100dd8ffc26b5ae81
SHA256:
455FBC9B8F7EE0D034B5AE7C5448DF04F8AA710315BAA79A3E10D6C57EC3D9CE
File Size:
1.14 MB, 1143548 bytes
|
|
MD5:
05e3e92e083c2e8326618759f6e9d774
SHA1:
a5451e8bc4dc02f4eebe711d96f846f80aed5d9e
SHA256:
5D9A47CA3A87F17EB43C583A16304C2EEF6CFCB8FB36727195EB7E80B9610D15
File Size:
1.16 MB, 1161596 bytes
|
|
MD5:
5b459eb2698a6fc6d2908c702c8e7d58
SHA1:
0bbd72cb8e53ba692b766d75a6a9e5972b6b4398
SHA256:
EF6C53634DD2EB2141F5FCAC375FB99A021835F007342970D372F9BC7790D34F
File Size:
1.14 MB, 1135448 bytes
|
|
MD5:
b555b66cf398d7df8b2f2a12bc5deddd
SHA1:
bd0f58bb28d1d2c5272f6b27e8b2387e45a75f25
SHA256:
F3E2E5A639887482DF5DA2DD4FA6128D6341FAE7450E73E61D94871AF5C80466
File Size:
1.14 MB, 1142176 bytes
|
|
MD5:
0e174536023334e994f426a767d74f1d
SHA1:
fef280c0623dd567af1895ec79daebcb97474605
SHA256:
D6C265F1C8EAC388A1A16E75545C2F760B93633CF8E5F26C8B286E784639BAFB
File Size:
1.14 MB, 1140212 bytes
|
|
MD5:
2de29cc72606d82de674906539fe3ed4
SHA1:
0dfc62f9261d2d639c3db256f2cc19b415683997
SHA256:
B27DB156953619B22EBC05140AF84033B36E1F1C07B7AD2BBC567D270D3C6D9F
File Size:
1.14 MB, 1136344 bytes
|
|
MD5:
68d4428364513c26d69db32c10fb701d
SHA1:
5990c00e577fda8da3efde9ff48ccf32fbb742f1
SHA256:
29F36A71363CDA29AE7FA3524B1AE317E283854D045480E0F3741B98A4F00222
File Size:
1.16 MB, 1161564 bytes
|
|
MD5:
14cf73c2b20efd6e0de10ff2035cad0e
SHA1:
6736039f9c670c6536ae5c7a720f3ccd2b4690aa
SHA256:
8DB8DE2AB79F2F75EF683A93A6FA1F18738D399FA9CFA4A0DC21832B6F5743D1
File Size:
1.14 MB, 1140664 bytes
|
|
MD5:
f64660d823b06add2c161cd66380e577
SHA1:
258ad3413ee5c28738b5f223f717fae0725b5922
SHA256:
8E9A266F67E2AB0CAB10C6FC8CD1510FCAD4A790691D0AA6DA14D894CF8F6985
File Size:
1.14 MB, 1137100 bytes
|
|
MD5:
8f6324e1dfe26898577f204c512b87c8
SHA1:
d90c70c49b6af3229f4c0c9b56d7b37c7d8776ae
SHA256:
901048F16D6BBA02A5230876D7B13C0D6564E083682B39A78DC467A1EED0BDA7
File Size:
1.13 MB, 1133560 bytes
|
|
MD5:
b58d9b3002cc4efb21aaeca41c563caf
SHA1:
56fc21b0a8c1e419359b4cbd400fa5dd77d6dd95
SHA256:
F9A136D81DE766E53CF532B80E23BBCC0758C2D355863F597F85446B15BCE6FD
File Size:
1.13 MB, 1127044 bytes
|
|
MD5:
3572fc163dc4f8c966423761ba153a9a
SHA1:
2c062c2789ce0005963fa221ea4a49cca3c2f246
SHA256:
CC7F9C3DD4A3A0ABE8328E5FE8C2A0D6CF7DE57848C507F486FBB07AB554E27D
File Size:
1.15 MB, 1151164 bytes
|
|
MD5:
94335283b092aaf0516b06b1a20314b0
SHA1:
8a6e887b4ff93bb0c4844d3d68f4ff601fd6ee81
SHA256:
260AF379BA99B1EE84B7546B3327F33618AD932FDC068E4604C3A891A5A2B9EC
File Size:
1.14 MB, 1138484 bytes
|
|
MD5:
ac90880794735946b0b78a963d256fbd
SHA1:
726c63db234911a56d76c4df109de9afd03c7f6b
SHA256:
981EB1CDA40EC5FFC1B0D2FB51D99F872584E1CEF81AEDFA9EFD916A5866DA38
File Size:
1.15 MB, 1151524 bytes
|
|
MD5:
4b889856034dd6bbfdfe07d3b8c63e6a
SHA1:
7453d3cba1f8dac19a96e3e11964eb981f6ec89a
SHA256:
ABBCE85500F4A22D2DC668B736C5C2EBFBDEC41F8940080E86CC691D6CD7BE68
File Size:
3.59 MB, 3586452 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- big overlay
- dll
- fptable
- HighEntropy
- Installer Manifest
- Installer Version
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,798 |
|---|---|
| Potentially Malicious Blocks: | 669 |
| Whitelisted Blocks: | 528 |
| Unknown Blocks: | 601 |
Visual Map
x
?
?
0
0
?
x
?
?
?
x
?
x
?
?
?
?
x
?
x
x
0
?
?
0
?
0
?
?
?
?
?
?
x
?
x
x
?
0
x
?
0
x
?
x
?
x
?
?
x
x
x
x
x
0
x
x
x
x
?
x
?
?
?
x
x
x
?
?
x
x
x
?
?
0
x
0
x
x
x
?
x
x
x
?
?
?
x
x
x
x
x
?
x
?
0
x
?
x
?
x
?
x
?
x
x
x
?
0
x
0
?
x
?
x
?
?
?
x
x
?
x
x
x
x
?
?
x
x
x
x
x
x
?
?
?
0
?
?
x
x
?
?
?
x
?
?
x
x
?
x
x
?
?
x
?
?
?
x
?
?
?
?
x
?
?
?
?
x
x
?
?
?
x
?
0
?
x
x
x
x
?
x
x
x
x
0
x
x
x
x
?
?
0
x
x
?
0
x
x
0
0
x
x
?
?
?
x
x
0
x
x
x
x
x
?
?
?
x
?
x
?
?
?
x
0
?
x
x
0
x
?
x
x
?
x
?
0
0
0
0
?
?
x
?
?
x
x
x
x
x
x
?
x
?
?
x
x
x
?
?
0
?
?
?
?
x
x
?
0
?
x
x
x
x
x
x
x
0
?
x
x
?
?
x
?
x
?
x
0
?
?
?
0
x
?
x
x
?
?
x
x
x
x
0
0
?
0
x
x
x
x
?
x
?
x
x
?
?
?
x
x
x
x
x
?
x
x
x
?
?
?
?
?
x
?
?
x
x
0
?
?
?
0
?
?
x
0
?
0
x
x
x
?
?
?
x
x
0
x
x
x
?
?
x
x
x
x
?
?
?
0
x
x
?
x
?
x
?
0
?
x
x
?
?
x
?
0
?
?
?
x
0
x
?
x
x
?
x
x
?
?
x
?
x
?
x
x
x
x
?
x
?
x
0
?
x
?
x
?
?
x
x
x
x
?
x
x
0
?
x
x
?
x
x
?
?
x
x
?
x
x
x
x
x
x
0
0
?
0
x
x
?
x
?
x
x
0
x
?
0
x
x
x
?
0
?
x
?
x
?
?
?
x
x
x
?
x
0
x
x
?
?
?
0
?
x
x
x
?
x
x
?
?
x
x
?
x
0
?
x
x
x
x
?
x
x
?
x
?
?
x
x
x
x
x
?
?
x
?
x
x
?
?
x
x
x
x
?
x
x
?
?
x
?
x
x
x
x
x
x
?
?
x
x
?
?
x
?
?
x
x
x
x
x
x
?
x
x
x
?
x
x
x
x
x
x
x
?
x
x
?
x
?
x
?
?
?
?
?
x
x
?
0
?
x
?
x
?
?
0
x
0
?
0
?
x
x
x
x
0
0
0
x
x
?
0
?
x
x
?
?
x
x
0
x
?
x
?
x
x
x
x
x
?
x
?
?
?
?
x
x
x
x
?
x
0
x
x
?
?
?
x
x
?
?
x
x
?
0
0
x
?
?
?
x
x
0
x
?
x
?
x
x
x
x
x
x
x
?
x
x
?
x
?
?
?
?
0
?
x
x
?
x
0
x
x
?
?
?
?
x
0
?
?
x
0
?
x
x
x
x
?
?
?
x
x
x
x
?
?
x
?
?
x
?
?
x
x
?
?
x
x
?
x
x
x
?
x
x
?
x
?
?
x
x
?
x
?
x
?
?
x
?
?
x
?
x
x
?
?
x
?
0
x
x
?
0
x
?
x
x
?
x
?
x
x
x
?
?
?
x
x
x
x
x
?
x
x
x
0
x
x
0
?
?
x
?
?
x
?
x
?
x
?
?
?
?
x
?
x
x
x
?
?
x
x
?
?
x
x
0
?
0
x
?
x
x
x
?
x
x
?
?
x
x
0
?
x
x
?
x
x
x
x
?
?
?
x
x
x
x
x
x
x
?
x
x
?
?
x
?
x
0
x
?
x
x
?
?
?
?
x
x
x
x
x
x
?
0
?
0
?
x
x
x
?
0
?
x
?
?
x
x
?
?
0
x
?
0
x
0
x
0
0
x
x
x
x
?
?
0
x
?
x
x
x
0
x
x
x
?
x
x
0
0
?
x
?
?
?
?
?
?
x
x
x
?
?
0
?
x
x
x
?
x
?
x
?
?
?
?
x
?
?
?
x
x
x
?
x
x
?
x
?
x
x
x
?
x
x
?
0
?
x
x
0
x
x
0
x
?
?
x
?
x
x
?
x
?
?
?
?
x
0
0
x
?
x
x
?
?
?
x
x
?
?
?
?
x
x
?
x
x
?
x
x
?
?
x
x
x
x
x
0
?
0
0
0
x
?
?
?
x
?
x
x
0
x
?
?
x
?
x
?
?
x
?
x
0
?
?
x
?
x
0
x
x
?
x
?
?
x
x
?
?
?
?
0
0
?
x
x
x
x
x
x
x
?
0
x
?
?
x
x
x
?
?
?
?
x
?
0
?
x
0
?
x
x
x
?
0
x
?
?
?
x
x
?
?
?
?
x
x
0
?
x
?
?
?
?
x
x
x
x
x
x
?
?
0
x
?
x
0
?
x
x
0
x
?
?
?
x
x
?
x
x
x
x
x
x
x
x
?
x
x
x
?
x
?
x
0
?
x
?
x
?
x
?
x
x
x
x
?
0
?
?
x
?
?
x
?
x
x
x
?
0
x
x
?
?
?
?
x
?
x
?
?
x
x
x
x
?
x
x
x
x
?
?
x
?
x
?
0
?
x
?
x
x
x
?
?
?
0
x
0
?
?
?
?
x
x
?
?
0
x
?
x
x
?
x
?
?
x
?
0
?
?
0
x
x
x
x
x
?
x
0
x
x
?
x
0
?
x
0
x
x
x
?
x
0
?
?
0
0
?
x
?
?
x
?
x
?
x
x
?
x
?
?
x
x
?
x
x
?
x
x
x
?
?
?
x
?
x
?
0
?
x
?
0
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
x
?
?
?
?
?
x
?
0
0
?
?
?
?
0
?
x
?
?
?
0
?
?
x
?
x
x
?
?
x
?
x
?
x
x
x
x
x
?
?
?
?
?
?
?
?
0
x
?
?
x
0
x
?
?
x
?
?
?
?
x
x
x
?
0
?
x
?
?
x
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
2
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.FTS
- Agent.KUH
- Agent.MIC
- Agent.MPD
- Agent.VYB
Show More
- CobaltStrike.SVN
- Injector.BIB
- Injector.BUB
- Kryptik.CTD
- Kryptik.CTF
- Kryptik.DEQ
- Kryptik.GTCG
- Kryptik.GTCI
- Kryptik.GTCJ
- Kryptik.GUB
- LockScreen.AG
- Lumma.JC
- Marte.CP
- Rozena.XV
- ShellcodeRunner.RRB
- Trojan.Agent.Gen.BCO
- Trojan.Agent.Gen.BGO
- Trojan.Agent.Gen.BNR
- Trojan.Agent.Gen.BPF
- Trojan.Downloader.Gen.KG
- Trojan.Injector.Gen.GOC
- Trojan.Kryptik.Gen.CFT
- Trojan.Kryptik.Gen.DBQ
- Trojan.Kryptik.Gen.DKA
- Trojan.Kryptik.Gen.DOM
- Trojan.Kryptik.Gen.DUH
- Trojan.Kryptik.Gen.DZH
- Trojan.Kryptik.Gen.EAW
- Trojan.Kryptik.Gen.EEG
- Trojan.ShellcodeRunner.Gen.KE
- Trojan.ShellcodeRunner.Gen.KI
- Trojan.ShellcodeRunner.Gen.KS
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Encryption Used |
|
| Anti Debug |
|
