Threat Database Trojans Trojan.MSIL.Krypt.DGK

Trojan.MSIL.Krypt.DGK

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 23,021
Threat Level: 80 % (High)
Infected Computers: 3
First Seen: November 7, 2022
Last Seen: May 10, 2026
OS(es) Affected: Windows

The detection of Trojan.MSIL.Krypt.DGK on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its operating mechanisms, symptoms of infection, and steps to remove it from your system. It's essential to address this issue promptly to prevent potential damage to your data and system integrity.

What Is Trojan.MSIL.Krypt.DGK?

Trojan.MSIL.Krypt.DGK is identified as a Trojan-type threat, which means it is a type of malware that disguises itself as legitimate software to gain unauthorized access to a computer system. The name suggests it may be related to malware that uses MSIL (Microsoft Intermediate Language) and possibly involves encryption or cryptographic functions, indicated by "Krypt." However, without specific details, it's crucial to focus on general guidance for removal and system protection.

How Trojan.MSIL.Krypt.DGK Operates

Trojan horses, in general, operate by deceiving users into installing them, often by disguising themselves as useful applications or piggybacking on legitimate software. Once installed, they can perform a variety of malicious actions, including data theft, installation of additional malware, or allowing unauthorized access to the infected system. The exact operation of Trojan.MSIL.Krypt.DGK would depend on its specific design and intent, which could range from financial fraud to espionage.

Symptoms of Infection

Symptoms of a Trojan infection can vary widely but may include unexpected changes to system settings, appearance of unfamiliar programs or icons, unexpected system crashes, or significant slowdowns in system performance. Users might also notice unusual network activity, such as increased data usage or unfamiliar connections. Since Trojans can be designed to operate stealthily, some infections may not exhibit noticeable symptoms, making regular system scans crucial for detection.

How to Remove Trojan.MSIL.Krypt.DGK

  1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while disabling most background applications.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated to the latest version to maximize its effectiveness against current threats.
  3. Uninstall any recently installed programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only uninstall programs you are certain are safe to remove.
  4. Reset your web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, etc.) to their default settings. This can help remove any malicious extensions or settings changes made by the Trojan.
  5. Reboot your system and perform another full scan to ensure the malware has been completely removed. Repeat this process if the malware is still detected after the first removal attempt.

Conclusion

Removing Trojan.MSIL.Krypt.DGK requires a combination of system knowledge, the right tools, and caution. By following the steps outlined above and maintaining good security practices, such as regularly updating your operating system and applications, using strong, unique passwords, and being cautious with email attachments and downloads, you can significantly reduce the risk of future infections. Remember, prevention is key, but when infections do occur, prompt and informed action can minimize damage and protect your digital assets.

Analysis Report

General information

Family Name: Trojan.MSIL.Krypt.DGK
Signature status: No Signature

Known Samples

MD5: c893415519ae620a87fb11c54c479929
SHA1: 0f0ac5252f234f96cf50bfe47d1e9a7ea2aa0abb
SHA256: EC1E7D0E4D6DEA580632181E9727B8E4D91C287F26E873EC97C8ECE8E5634691
File Size: 1.14 MB, 1139200 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version 3.2.5.148
Comments Advanced system optimization and update management tool
Company Name NexaSoft Technologies Ltd.
File Description Core System Engine
File Version 3.2.5.0
Internal Name OvzH.exe
Legal Copyright © 2026 NexaSoft Technologies. All rights reserved.
Legal Trademarks Nexaâ„¢ is a registered trademark of NexaSoft
Original Filename OvzH.exe
Product Name Nexa Update Manager Pro
Product Version 3.2.5.0

File Traits

  • .NET
  • GenKrypt
  • HighEntropy
  • x64

Block Information

Total Blocks: 289
Potentially Malicious Blocks: 79
Whitelisted Blocks: 124
Unknown Blocks: 86

Visual Map

0 ? 0 x 0 ? 0 0 0 ? 0 x 0 ? 0 0 0 ? 0 x 0 ? 0 x 0 ? 0 x 0 ? 0 x 0 ? 0 0 0 ? 0 x 0 ? 0 0 0 ? 0 0 x ? x x ? ? ? ? ? ? ? ? ? ? ? 0 x ? ? ? ? x ? 0 0 x ? ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? ? ? x ? ? ? x ? ? ? ? ? x ? ? ? 0 x 0 x 0 x 0 x 0 x 0 x ? ? ? ? ? ? ? ? x x x x ? ? ? x ? ? ? ? ? ? ? ? ? ? x x x x 0 ? 0 0 x x 0 0 0 0 ? 0 x 0 0 0 x x 0 ? 0 x 0 x 0 x 0 ? 0 x 0 x x 0 x 0 x 0 x 0 x 0 x 0 x 0 0 0 0 0 x x 0 x 0 x 0 x 0 0 x x 0 0 x 0 x 0 0 0 x 0 0 x 0 x 0 0 0 0 0 0 0 0 x 0 0 0 x x 0 x 0 0 0 x 0 x 0 x 0 0 0 x 0 x 0 x 0 x 0 x 0 x 0 x 0 0 x 0 x 0 x 0 x 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.Krypt.BVB
  • MSIL.Krypt.DGK

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
Show More
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN
User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Anti Debug
  • IsDebuggerPresent

Related Posts

Trending

Most Viewed

Loading...