Trojan.Kryptik.Gen.MJD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| First Seen: | November 5, 2026 |
| Last Seen: | November 8, 2026 |
| OS(es) Affected: | Windows |
Trojan.Kryptik.Gen.MJD is a Trojan that targets Windows computers. It has a danger level of 8 out of 10. Trojans pose as harmless files or hide inside other downloads, then run silently in the background. The Kryptik name is commonly used for generic detections of packed or obfuscated malicious executables. According to the feed data, this threat was first seen on 2026-11-05 and most recently on 2026-11-08, with one detection recorded so far.
Table of Contents
What the threat does
Trojan.Kryptik.Gen.MJD installs itself stealthily and performs malicious functions without the user noticing. Once installed, it may allow attackers to gain complete control over the infected system.
The analyzed sample gives some insight into its behavior:
- Weakening Microsoft Defender. The sample launched a hidden PowerShell command that adds the user profile folder and the ProgramData folder to the antivirus exclusion list. Once those locations are excluded, other malicious files stored there may avoid scanning.
- Anti-analysis checks. It uses debugger-detection functions, which malware commonly uses to avoid being studied by researchers.
- Process manipulation. It calls a function that unmaps memory sections from a process, a technique often associated with hiding or injecting code.
- Privilege and token handling. It adjusts token privileges and works with process and thread tokens, which can be used to gain higher access rights.
- User information gathering. It reads the user name and locale settings.
- Encryption functions. It uses a Windows cryptographic API. The feed does not say what it encrypts.
The file is an unsigned 64-bit native Windows GUI executable with no version information and high entropy, which usually points to packed or encrypted content. It also has no resources and no debug information. Of the 2,977 behavior blocks recorded, 238 were flagged as potentially malicious.
How it usually gets onto computers
The feed says this Trojan most often spreads by:
- Exploiting system vulnerabilities and security flaws.
- Software downloads from malicious websites.
- Email attachments from untrusted sources, usually .exe, .pif, .avi and even .jpg files.
Files with double-meaning names, such as an executable made to look like a picture or video, are a typical trick used by Trojans.
Risks for the user
Because the Trojan may give attackers full control, the risks are serious. The feed does not list specific payloads, but Trojans of this type typically lead to:
- Theft of passwords, personal data or financial information.
- Installation of additional malware.
- Remote access to your files and system.
- Reduced protection, as the antivirus exclusion command in this sample shows.
Signs of infection
Trojans are designed to stay hidden, so there may be no obvious symptoms. Watch for these clues:
- Unexpected PowerShell windows or processes, especially hidden ones.
- New exclusions in your antivirus settings that you did not add, particularly for your user profile or ProgramData folders.
- Temporary PowerShell script test files appearing in your Temp folder. The sample created files with names beginning with __psscriptpolicytest, though these can also be created by legitimate activity.
- Unexplained slowdowns, odd network activity or security tools that stop working.
How to stay protected
- Keep Windows and all your software updated to close the vulnerabilities Trojans exploit.
- Do not open attachments from unknown senders, and be suspicious of files whose type does not match their description.
- Download software only from official sources.
- Use a reputable, up-to-date security solution with real-time protection, and review its exclusion list regularly.
- Use a standard user account for daily work instead of an administrator account.
- Back up important files regularly and keep a copy offline.
If you suspect infection, disconnect from the internet, run a full system scan, and check your antivirus exclusions for entries you did not create. Change your passwords from a clean device. If the system remains unstable or suspicious, consider professional help or a clean reinstall of Windows.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.Gen.MJD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
f62b3425f07e81094ad79b50f253c29a
SHA1:
c66b36668f6bac7885821c57781800a891c90c28
SHA256:
8F9E9270D8DB10200AB80B702A28E7AF6AA7766C760EEFF437CD28F73B67C9FA
File Size:
946.18 KB, 946176 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show 3 more
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- HighEntropy
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,977 |
|---|---|
| Potentially Malicious Blocks: | 238 |
| Whitelisted Blocks: | 2,736 |
| Unknown Blocks: | 3 |
Visual Map
... Data truncated? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Trojan.Kryptik.Gen.MFI
- Trojan.Kryptik.Gen.MJD
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134385186767585482.292.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_dg51ajza.axl.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_t2zy1fbw.03b.psm1 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\windows defender\exclusions\paths::c:\users\vtblhtaf | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows defender\exclusions\paths::c:\programdata | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 衛溝ǝ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show 90 more
24 additional items are not displayed above. |
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @($env:userprofile,$env:programdata) -Force"
|
