Trojan.MSIL.Downloader.TKB
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 7,603 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 245 |
| First Seen: | March 20, 2023 |
| Last Seen: | April 15, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Downloader.TKB |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
b81e11e838c2b9da613ab2ae4cee35a1
SHA1:
efd1f61a8d777a7937656be0aa6b9cf6ef0acdf6
SHA256:
E027E376F3EA2CAF426E3C411633C3992ADB8618DD0DE7E76A45BC2922679C9B
File Size:
3.47 MB, 3465312 bytes
|
|
MD5:
bafb2cde80f391fb81167784c864a5b1
SHA1:
63df33ac18c231a5cd7362ab7713d5af8e58745d
SHA256:
D193A2CBAEFBD88359EF34FFA7D64BBCB882ECDA2BC6B79B64428EF6E4A8651B
File Size:
587.69 KB, 587688 bytes
|
|
MD5:
13e0908cc284fd522feb8cab48fa2ab3
SHA1:
c91fb01d85636097bedc4843065cefca5af74106
SHA256:
139A5BB6299E22FD1EF2DB0E8327860ED5FEF20D0C098A3EDBBF32547856987A
File Size:
2.92 MB, 2920448 bytes
|
|
MD5:
e6727eadce0fa93da78c94532824ee69
SHA1:
388b278d95c5567cb97231bfd8119d7b436efc29
SHA256:
F6911DB23277E688624F46BBAA232BC8B13B879ADA113D4B0BE385390169CAC8
File Size:
2.11 MB, 2112000 bytes
|
|
MD5:
d535a63a1eeed2ebc5f641312d60d834
SHA1:
04e4a31ac4398447bf2286a8de7bfc32a35745e6
SHA256:
257D8EF9B0928B4629C3F6AF24EFE634CC345C2006A481540B9411EA49FF0562
File Size:
1.29 MB, 1290240 bytes
|
Show More
|
MD5:
cc234e2509a76e3baabddd7fd10e351f
SHA1:
8ecaf386286af01f57f1385cfed5164e017ddb1a
SHA256:
51895D8056D4CCFDFADF1FDDC285617369C7D201B3B13D14CC1B3E8F8D39E084
File Size:
3.29 MB, 3294720 bytes
|
|
MD5:
76e2ee1161617b8661221e1a7e350b35
SHA1:
0405dd34dffeff468c9bb655edefd9448249d268
SHA256:
83FCBE2B97755FDAB7BBF841951544E669457827B384549CAD40BBD5BC7D857F
File Size:
709.71 KB, 709708 bytes
|
|
MD5:
90bf67689fa539a1bb8d5069d30ff997
SHA1:
a5c7cd63e1d36335f769cc6cf4c92673b8547b17
SHA256:
792DBB31396BF01595C2BAC8AC0195DE618E7375A0F48647083822E8461B2C4F
File Size:
2.35 MB, 2353528 bytes
|
|
MD5:
db57e5f364a6223d39cfc8250a904166
SHA1:
2b78b3c22ce583a6373a1d654a6ab962702579bc
SHA256:
A579B5AFCE45E82364D9BEDFB8BD54161AD17CD86F06CFCCA97710EC579C8884
File Size:
1.50 MB, 1503608 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Big Dutchman Service GmbH | BD-MANU-CA | Self Signed |
| DigiCert Global Root G1A | DigiCert Global Root G1A | Self Signed |
| Nir Sofer | UTN-USERFirst-Object | Hash Mismatch |
File Traits
- .NET
- HighEntropy
- NewLateBinding
- ntdll
- RijndaelManaged
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,409 |
|---|---|
| Potentially Malicious Blocks: | 143 |
| Whitelisted Blocks: | 150 |
| Unknown Blocks: | 1,116 |
Visual Map
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
?
?
?
?
x
?
?
?
?
?
?
?
?
0
?
?
x
x
?
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
?
?
?
?
?
?
?
?
?
?
?
x
?
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
?
?
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
x
x
x
x
x
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
?
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
?
?
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
?
x
?
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
?
?
?
?
?
?
?
?
0
?
?
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
?
x
?
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
?
0
0
0
0
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
0
?
0
?
0
?
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
?
?
0
?
0
?
?
?
0
?
?
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
0
0
0
?
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
x
x
?
x
x
x
x
?
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.Agent.BTIF
- MSIL.Agent.FFL
- MSIL.Agent.HGF
- MSIL.ArchSMS.A
- MSIL.Downloader.Agent.AFU
Show More
- MSIL.Downloader.FO
- MSIL.Krypt.ABTPHE
- MSIL.Krypt.ABTPHU
- MSIL.Krypt.GBTB
- MSIL.Krypt.ZSF
- MSIL.Krypt.ZST
- MSIL.Spy.Agent.GC
- MSIL.Stealer.MA
- MSIL.Stealer.XE
- MSILZilla.VBA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\kteqexwgrm.exe | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Anti Debug |
|
