Trojan.Kryptik.Gen.EKL

Trojan.Kryptik.Gen.EKL is a high-risk Trojan horse that targets Windows computers. Classified as dangerous with a severity rating of 8 out of 10, this threat is designed to infiltrate systems quietly, carry out malicious actions in the background, and potentially hand attackers control over an infected machine. Because it belongs to the broad and prolific Kryptik family of Trojans, Trojan.Kryptik.Gen.EKL shares many traits with related detections such as Trojan.Kryptik.Gen.FQK and Trojan.Kryptik.Gen.FZB, all of which rely on similar stealth and evasion tactics.

What Trojan.Kryptik.Gen.EKL Does

Once active on a system, Trojan.Kryptik.Gen.EKL runs silently in the background without any visible interface, making it difficult for an average user to notice anything unusual. It is built as a native 32-bit Windows application and shows signs of high entropy, a characteristic often associated with obfuscated or encrypted malicious code designed to resist analysis and detection. The sample observed was also found with a digital signature that did not match its file hash, meaning it attempted to appear legitimately signed while actually failing verification — a common trick used by malware authors to lend false credibility to their files.

Behaviorally, this Trojan has been observed using techniques associated with process manipulation and evasion, including methods that can be used to hollow out or tamper with legitimate processes in memory. It has also been seen accessing user object information, which can be a step toward surveillance or further system reconnaissance. During infection, it creates and modifies cache and metadata files in hidden system folders, which it may use to store downloaded components, configuration data, or stolen information before transmitting it elsewhere.

How It Usually Gets Onto Computers

Like most threats in the Kryptik family, Trojan.Kryptik.Gen.EKL typically spreads through deceptive means rather than exploiting a single specific vulnerability. Common infection paths include software downloaded from untrustworthy or compromised websites, bundled installers, and email attachments disguised as harmless files — including executables, media files, or image files that actually conceal malicious code. In many cases, it may also arrive through exploitation of unpatched system vulnerabilities, allowing it to install itself without the user's knowledge or consent.

Risks for the User

The consequences of a Trojan.Kryptik.Gen.EKL infection can be severe. Once established, this type of Trojan can give remote attackers significant control over the infected machine, potentially allowing them to steal sensitive data, install additional malware, monitor user activity, or use the system as a launchpad for further attacks. Its evasion techniques make it harder for security tools and users alike to detect and remove, increasing the risk of prolonged, undetected compromise.

Signs of Infection

Because Trojans like this are designed to operate covertly, infections are often hard to spot. Users should watch for unexplained system slowdowns, unusual network activity, unfamiliar files appearing in system folders, unexpected crashes, or security software reporting suspicious detections. The presence of unknown cache or metadata files in hidden application data directories, as seen with this threat, can also be a warning sign.

How to Stay Protected

To reduce the risk of infection, avoid downloading software from unofficial or suspicious websites, and never open email attachments from unknown or untrusted senders. Keep the Windows operating system and all installed software fully updated to close security gaps that Trojans often exploit. Running reputable, up-to-date security software and performing regular system scans can help detect and remove threats like Trojan.Kryptik.Gen.EKL before they cause lasting damage. Maintaining regular backups of important data also helps limit the impact of any successful infection.

Analysis Report

General information

Family Name:	Trojan.Kryptik.Gen.EKL
Signature status:	Hash Mismatch

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 6ee24211c870cfa69b6f3308459668df SHA1: 78f05bd41f29448afecd416bd6545371282f3c39 SHA256: 63BA3A7317F12EFB1090152C900234CBE86477B81CEEFAC2987055D289D8FE1D File Size: 657.68 KB, 657680 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show 1 more

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
File Version	1.0.0.0
Product Version	1.0.0.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
QIHU 360 SOFTWARE CO. LIMITED	Symantec Class 3 SHA256 Code Signing CA	Hash Mismatch
QIHU 360 SOFTWARE CO. LIMITED	VeriSign Class 3 Code Signing 2010 CA	Hash Mismatch

File Traits

• HighEntropy
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	1,996
Potentially Malicious Blocks:	2
Whitelisted Blocks:	1,994
Unknown Blocks:	0

Visual Map

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Banload.XT
• Kryptik.BDEA
• Trojan.Krypt.Gen.RNS
• Trojan.Kryptik.Gen.EKL
• Trojan.Kryptik.Gen.FQK

Show 1 more

• Trojan.Kryptik.Gen.FZB

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b46811c17859ffb409cf0e904a4aa8f8	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f93e23f30c5b44ae13f273c2767b494e	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f93e23f30c5b44ae13f273c2767b494e	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection