Trojan.MSIL.KillWin
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,275 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 540 |
| First Seen: | May 23, 2024 |
| Last Seen: | April 3, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.KillWin |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
088655e14c66f121158b501256e3bf2b
SHA1:
2f6fca52b1bfe8a397cb217f10e60b5db8bd4883
File Size:
2.76 MB, 2759168 bytes
|
|
MD5:
3b3dced2cdbdaa683b492b524cb377aa
SHA1:
f97b1c0192017bd72e828f31cba708136acfbb42
File Size:
1.80 MB, 1802240 bytes
|
|
MD5:
3b64cfa79378cf26c8d0b03ad3494122
SHA1:
19c7ad087f9920fe016872cb77057df297778c11
SHA256:
A5ED69B4AACDFD41D53C667310B4FB2713A53BAD5335A290BE7A9F4F8741AA17
File Size:
1.65 MB, 1650688 bytes
|
|
MD5:
26bce72fdbd3574616ea09e175e8f3f3
SHA1:
7ddd2c14317fbb0d3e49c16956b1e006095fd8a1
SHA256:
63C5C1E0D2DB93EB735912E2C3970C19583E5096507BC6282F515BC8E9FCF2A4
File Size:
2.43 MB, 2433536 bytes
|
|
MD5:
30e4acb338ec3b50f93e20ce94251cdf
SHA1:
d619fee8c45409c60496c8ef9bb95b1f34ac2984
SHA256:
B4704D0A1109339FB2EAAC52FAA4EE6E7F905B97C1C51C588121D771F5765C3C
File Size:
713.73 KB, 713728 bytes
|
Show More
|
MD5:
6b8bf7b9cb17f358289fb30f1f61bb26
SHA1:
89dd8568359613dbfa231ef0ac038547f8065579
SHA256:
7111678DE168BCC21D37241BC842466DBFCDAC5300E01F2AB56C583D731C7B83
File Size:
1.65 MB, 1654784 bytes
|
|
MD5:
61f6bf802445f33ca2001fb7695bc740
SHA1:
651f1ee23e0e270bccb465130797edf2f4caade5
SHA256:
43FFB7DFB784161C3FE308DA40C171D3DDF4A285A6B2E64BD601F60AB82CF006
File Size:
238.59 KB, 238592 bytes
|
|
MD5:
8df0fa9794a50cecac005a555df7ffc5
SHA1:
89f4e43e41380a88680067dc633179ed1f1e8545
SHA256:
C9B0939520D194B0140F6A65CFCF3708E0947833CD6DD4E161BEC7BDA995F991
File Size:
2.74 MB, 2742272 bytes
|
|
MD5:
ca2709d69c2bdfefefd36227aa44b2be
SHA1:
1f74b7b9107203dead7c6a1abe5bfcf0b8b4907c
SHA256:
D7D26B4A52DC41A731F0C3ADF9DDCC7CFD399F8144E422B0B88336FF56AC58F3
File Size:
2.66 MB, 2663424 bytes
|
|
MD5:
e5ab5d5cb0302bd62cc8c5e62a0d52fe
SHA1:
b184100b69df0ca08a8b8dec1f621c2e75cd44c9
SHA256:
74D73B2D1C18C5B237A44326F0C371337433E37DA95F860F59FE542DD07B39DD
File Size:
67.58 KB, 67584 bytes
|
|
MD5:
a7c0a12648e3284b3051dbc5e4e75422
SHA1:
db5250eeca0d9c1f06372ee21e011593fc136fe0
SHA256:
50BF7D968FCF5B58C1EDBC9379B650788416302F3F5203BA76E2867E7B585679
File Size:
6.05 MB, 6054912 bytes
|
|
MD5:
6a37fe248511105d42b8eab92e7876e3
SHA1:
426227d6168c929ea690e73e460f700c697fa5a5
SHA256:
6317C5BA9AED93E2D97DA5B76F04DCE79014C335BA2D329C170C75977B8A0768
File Size:
2.66 MB, 2663424 bytes
|
|
MD5:
17ec2a18af0112f8b1e754d92f985cba
SHA1:
6fea4471f9d068e1cb38b675f657997f581353e7
SHA256:
3AB28857360C990A8AD9DB736A1686E519C6A625FCE56F3E536AFDD3A6E9FB50
File Size:
13.82 KB, 13824 bytes
|
|
MD5:
339457843416e571f345bfdb3cd13528
SHA1:
806032da5942b872210c42f27c99161b9a2a8f0e
SHA256:
3CFDEAE42C79B27D8AF08FC5F31E35F05EEDC3E4BB9E6AC5E74033046A978F49
File Size:
2.67 MB, 2666496 bytes
|
|
MD5:
84a121310670143d5dd1b4f6c46dd51d
SHA1:
2bd5cf1ca0a93a7cf5f61c0b524b20c5028d848a
SHA256:
2B70FA90EC68453680A1AACB31EFEFA9E48CB3323220F73A6C0BD445AFF75BFC
File Size:
32.26 KB, 32256 bytes
|
|
MD5:
4358c18d978c6cb887adf5ffcd54b267
SHA1:
93b58708f609623ad60b3a939b50a4b40b7a8497
SHA256:
20F9E059D24C0D400AA9CF0CD313E1E12A25AAD9E68DEBFDEB66EC0D43D2ABE4
File Size:
4.04 MB, 4044087 bytes
|
|
MD5:
373087cb46d160310c895821e8ff5eea
SHA1:
462a55a7e46a7e19a0b02fb1333a1cbe82a550dc
SHA256:
80EECF2DFE9E105CC670536071C287608874E9C356307DC2303CE834ABB5C5C5
File Size:
1.57 MB, 1572864 bytes
|
|
MD5:
08122f8c76e921c108acec86f00b4265
SHA1:
15b9bd8c304906f1fef2befb0c01541f7e6ba99b
SHA256:
6C79151B438112C00F6496A5DDC1F7305CCA131D900D05D466C41CD6DB96533A
File Size:
6.33 MB, 6331904 bytes
|
|
MD5:
bc1442276fbb89b93b9d4c3a30d6ca36
SHA1:
cab92fc8001879348b8e971a64543d956274e4a4
SHA256:
CD09B2EDACD89E8B74B75952180710C91A548AE71CCE62B472D2EC2416BCB794
File Size:
2.66 MB, 2663424 bytes
|
|
MD5:
f704ff496ffbae1ffbc4613403a54be6
SHA1:
a03c4b766bb37f5fc63dcf852ad880e217d0b92d
SHA256:
2B39AF881DB6C6DF1164D5057772442668D77DF704B25BEB265E48704C80B434
File Size:
4.04 MB, 4044087 bytes
|
|
MD5:
2e5ae53254909d3d0b6998f5b7717cfe
SHA1:
89e8206298c9a7333a74765d3aa08ee3fe224021
SHA256:
99A31373F140FACEE4A5D148FCE1699D37501FCE192B1C666DE388BED84F8610
File Size:
3.61 MB, 3614007 bytes
|
|
MD5:
ba48baec3dfa19b509ac403adfa01ba7
SHA1:
54b289e0b64432e6c55cdbb5e50c6edc2c645c09
SHA256:
6CE3137D586AE7B10C6AA76398B8FC9790FB997D9F3BC15E200B399E3A19E8E7
File Size:
2.69 MB, 2688512 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
Show More
|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks | WinPaletter |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- .NET
- .sdata
- dll
- Gdrive
- HighEntropy
- Installer Version
- NewLateBinding
- ntdll
- Run
- x64
Show More
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 378 |
|---|---|
| Potentially Malicious Blocks: | 8 |
| Whitelisted Blocks: | 102 |
| Unknown Blocks: | 268 |
Visual Map
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
0
?
0
?
?
?
0
0
x
?
?
0
?
?
0
?
?
?
?
?
0
?
0
0
0
?
0
?
?
?
?
0
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
x
?
0
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
?
?
0
?
?
?
0
?
0
?
0
?
?
?
?
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
0
0
0
0
0
0
?
0
?
0
?
?
?
x
x
x
x
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
0
?
?
0
?
0
?
0
?
?
0
?
0
?
?
0
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
x
0
0
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
?
?
?
?
?
?
0
?
?
0
?
?
0
0
?
?
0
?
?
?
?
x
?
?
?
?
?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Gametool.X
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\dly0cfjr.newcfg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\dly0cfjr.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\o4n2bgds.newcfg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\o4n2bgds.newcfg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\o4n2bgds.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\rks3qhwd.newcfg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\rks3qhwd.newcfg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\rks3qhwd.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\uo0s4tsd.newcfg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\uo0s4tsd.newcfg | Synchronize,Write Attributes |
Show More
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\uo0s4tsd.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\user.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\gta_v_install_path_tool\462a55a7e46a7e19a0b02fb13_url_j1keluogzvwqi3dlgca1w4dazylcltn4\9.2.0.0\user.config | Synchronize,Write Data |
| c:\users\user\appdata\local\gta_v_install_path_tool\gta v installpath tool.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::licenseaccepted | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::autoupdateschecking | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::autoaddext | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::draganddroppreview | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::win7livepreview | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::openingpreviewinapp_or_appliesit | RegNtPreCreateKey |
Show More
| HKCU\software\winpaletter\settings::autorestartexplorer | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::autoapplycursors | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::resetcursorstoaero | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::custompreviewconfig_enabled | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::showlogwhilesaving | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::complexsaveresult | 2.1 | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::showsaveconfirmation | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::saveforlegacywp | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::mainformwidth | і | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::mainformheight | ˕ | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::mainformstatus | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::updatechannel | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_dark | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_auto | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_custom | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_schemename | Default Dark | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::appearance_custom_dark | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_accent | 凒 | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::appearance_back | ᤙ９ | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::appearance_rounded | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::appearance_win11_mica | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::whatsnewrecord | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::language | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::language_file | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::nerd_stats | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::nerd_stats_hexhash | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::nerd_stats_kind | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::terminal_bypass | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::terminal_otherfonts | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::terminal_path_deflection | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::terminal_stable_path | C:\Users\user\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::terminal_preview_path | C:\Users\user\AppData\Local\Packages\Microsoft.WindowsTerminalPreview_8wekyb3d8bbwe\LocalState\settings.json | RegNtPreCreateKey |
| HKCU\software\winpaletter\settings::cmd_overrideuserpreferences | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::log_showapplying | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::log_countdown_enabled | RegNtPreCreateKey | |
| HKCU\software\winpaletter\settings::log_countdown | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
43 additional items are not displayed above. |
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\19c7ad087f9920fe016872cb77057df297778c11_0001650688.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\89dd8568359613dbfa231ef0ac038547f8065579_0001654784.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\651f1ee23e0e270bccb465130797edf2f4caade5_0000238592.,LiQMAxHB
|
