Trojan.Kryptik.OSC
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Kryptik.OSC |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
19bda446099183a3658dab5ad8437411
SHA1:
94087e5417eca6df36f8fc3e1a32ab80b535cc02
SHA256:
B832AD36977DF2BE73CB4A0D8B99D3DC86C722AE21820D63DEE92C4ED06B536D
File Size:
2.44 MB, 2436584 bytes
|
|
MD5:
87b21928a968e57c328c61b96153f0f2
SHA1:
7dcec90c1247a0ffccd83102c4f7eb867d8eb4e0
SHA256:
DFBB76DA6AB0F1D1A372003500008A41FC98023A44C7819F8F8600747D5442C0
File Size:
2.92 MB, 2923536 bytes
|
|
MD5:
b70366535deff374a88c42a530df0d72
SHA1:
552dc8b830b43ae2fe0b41d37ecb6ad064670dc5
SHA256:
CB4387BD41F376753CB67C9068C565ABA54ED4DC10DA92DB0699E9CFAF7C9111
File Size:
8.21 MB, 8205784 bytes
|
|
MD5:
b29f2c79457996242770da3a18396bef
SHA1:
d8eaf1bfe14b3767ab6949274b5459deb9e6e604
SHA256:
0B12A1E35C4D8464BA592C140726330CDED2375CC975CD536E439EDEFDF9727B
File Size:
8.18 MB, 8184304 bytes
|
|
MD5:
a083d58325bebaf5ef95bd1a4970eaa7
SHA1:
cdea3284a5f2cd602512882269143b265b787b58
SHA256:
43CF605BC41C6F4B3C5EC7DD9A8A12732F81AE97A8C5DFC4FCC526D3B52CEB2A
File Size:
761.87 KB, 761872 bytes
|
Show More
|
MD5:
0e0d4d1febfee79ef6bd40ad44fa5283
SHA1:
a7d86fadf9092387715764e6f2a024b89452b2f2
SHA256:
3EE4E1D8021AD6C0771C1BD5C13636BE3ED9392C7DC52951EE4BA02A6F621327
File Size:
2.18 MB, 2182224 bytes
|
|
MD5:
a9ea798befc47317120b1e258e422392
SHA1:
4bbfbd989b8b475e6e81a3d331b95c58fadb67b9
SHA256:
730FDAEC9B6F9A98D151AF0D9F4094DA6DA1EA1B341AD6A27B74476FFF3E1FFC
File Size:
2.22 MB, 2224680 bytes
|
|
MD5:
f2ce3f3553c8b892e48a962aa06da3de
SHA1:
6a4c679bb054dde5a3d80f26cd5fb156fb4afc46
SHA256:
8D31D2BDC412EDB2BC62C04A3337096A11A4F1C0E343E958B1DB539B17F3C2F0
File Size:
3.00 MB, 2999768 bytes
|
|
MD5:
23d4138b49ae3def22d35e96532845ab
SHA1:
fc907dc81a6ec32ad326165ae776bd198196443e
SHA256:
C596D7EE57AF9005FF06C449179B221B73895D920F32A0A7D2B56F79512B8BE4
File Size:
1.84 MB, 1838592 bytes
|
|
MD5:
a7fe57c0c1e752c1963e61762712d3e0
SHA1:
9b76d2dd39853a5702eb75f4347e9a0fe74ebe45
SHA256:
A2919B7724AA43D66810DF901C677E01B6C8AC3C98462AAE01728708DBC7EB1F
File Size:
732.70 KB, 732696 bytes
|
|
MD5:
6b5781eb6d94c66693cddd463e86ab25
SHA1:
03cef69bad17e0c3b02e2601258d733354d5e2a8
SHA256:
3E153A7EDB74F3950D50BCF968418184648A7F195FD81268F77525E9B97C6960
File Size:
2.92 MB, 2915392 bytes
|
|
MD5:
17bd27ce45e1ddb28dcb8d601426a126
SHA1:
fd8db28911fb307aecec9f5a229ef40ac70f0447
SHA256:
652A6DE76CE62A798E533E3560236B38034149044CE7D79DF059A840249DE8BE
File Size:
4.04 MB, 4040248 bytes
|
|
MD5:
a6dde5142cd9cb21e8951d0fcc9de266
SHA1:
9e06c37c97abd64cacf0bbb2c2b2a241da7d7bfb
SHA256:
B4A174E02C3395B64D65F46FEE0352C3A54BD0F8741D267A363001AE9944DF92
File Size:
6.03 MB, 6028752 bytes
|
|
MD5:
f5a69f8a757dfb2aa06b28baae4ba38f
SHA1:
54fe986164fa06d43edf2c4e713d0b7760c496bd
SHA256:
78F7DD516E5399A15873336A70F3E157AB3066F9D0E9081BA1D42F796F923528
File Size:
4.96 MB, 4958192 bytes
|
|
MD5:
b60a829770d27f001b9dc744647564c2
SHA1:
827511fa92035d9ea1461b9951517647ee62c2b4
SHA256:
935D395F7DED23C45F4F8791287984D3E8944CA5CD919DB4A47043D1A2CC327E
File Size:
2.99 MB, 2986008 bytes
|
|
MD5:
1f9d75e8d2315b9ba551426be96af8c2
SHA1:
4dff1415c91f7e0e69453f68bc38a06bfa9f9aca
SHA256:
83D3C01A920B1AAE9D74D27D8AE86D49371CF54449E3FCC1AEBF11294B519D98
File Size:
3.49 MB, 3486720 bytes
|
|
MD5:
9e965876a90bf4dad8784e77a6c39d56
SHA1:
63e1fc26e56e4a86d98179a64fafd775110d0c72
SHA256:
C4D326698CC8BA8DB3AE5D247C0FBA5032C3214326518F37BD66AB72EDF03E7F
File Size:
724.94 KB, 724936 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
41 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
Show More
|
| Company Name |
Show More
|
| Company Short Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
Show More
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Short Name |
Show More
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| AdaptiveLogicFuture | AdaptiveLogicFuture | Self Signed |
| BetaSmart-OrbitWave | BetaSmart-OrbitWave | Self Signed |
| CyberCore Implementation | CyberCore Implementation | Self Signed |
| CyberCoreUniversal | CyberCoreUniversal | Self Signed |
| DynamicEdge-Total | DynamicEdge-Total | Self Signed |
Show More
| KineticNodeCorporationSaaS | KineticNodeCorporationSaaS | Self Signed |
| KineticNodeFutureQuantum | KineticNodeFutureQuantum | Self Signed |
| ParallelFlowImplementation | ParallelFlowImplementation | Self Signed |
| QuantumLink&Distribution | QuantumLink&Distribution | Self Signed |
| RiftPixel-CodeVantage-EdVibe | RiftPixel-CodeVantage-EdVibe | Self Signed |
| RiftQuest FluxPath | RiftQuest FluxPath | Self Signed |
| ShadowSynaptoGrid | ShadowSynaptoGrid | Self Signed |
| StarkDataSynapCoreGameForge | StarkDataSynapCoreGameForge | Self Signed |
File Traits
- 2+ executable sections
- HighEntropy
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 186 |
|---|---|
| Potentially Malicious Blocks: | 130 |
| Whitelisted Blocks: | 56 |
| Unknown Blocks: | 0 |
Visual Map
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
x
x
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
0
x
0
x
x
x
x
x
x
x
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
0
x
x
0
x
x
0
x
x
0
x
x
x
x
0
x
x
x
x
x
x
0
x
x
0
x
x
0
x
x
0
0
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Kryptik.OSC
