Trojan.MSIL.Krypt.GDE
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 11,205 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1,113 |
| First Seen: | September 19, 2021 |
| Last Seen: | October 13, 2026 |
| OS(es) Affected: | Windows |
Trojan.MSIL.Krypt.GDE is a Windows-based Trojan horse that has been actively detected since late 2021 and continues to appear in the wild. Built on the Microsoft .NET framework, this threat is classified as highly dangerous, carrying a risk rating of 8 out of 10. Like most Trojans, it is designed to infiltrate a system quietly, avoid detection, and carry out harmful operations without the user's knowledge or consent.
Table of Contents
What Trojan.MSIL.Krypt.GDE Does
Once active on a system, Trojan.MSIL.Krypt.GDE runs silently in the background, performing malicious functions while giving no visible indication to the user. This Trojan is capable of giving remote attackers a significant degree of control over the infected machine. Depending on the variant and the attacker's goals, it may covertly delete files, install additional malicious components, or otherwise manipulate the system without authorization. Because it is a .NET application, it can be compact and relatively easy for attackers to modify, repackage, and distribute in slightly different forms, which helps it evade some basic detection methods. Analysis of the file shows it does not carry a digital signature, lacks the typical metadata found in legitimate software, and shows signs of obfuscation—traits commonly associated with malware designed to resist analysis and detection.
How It Usually Gets Onto Computers
Trojan.MSIL.Krypt.GDE typically spreads through deceptive or exploit-based methods rather than by convincing users to install it directly. Common infection paths include:
- Software downloads from untrustworthy or compromised websites
- Email attachments from unknown or untrusted senders, which may be disguised as executable files, images, videos, or other seemingly harmless formats
- Exploitation of unpatched system vulnerabilities and security flaws that allow the Trojan to install itself without clear user interaction
Because the infection process is often stealthy, victims may not realize anything has been installed until unusual system behavior appears or security tools flag the file.
Risks for the User
The presence of this Trojan on a system poses serious risks. If it grants attackers remote control, they may be able to access personal files, monitor activity, harvest system and user information, or use the infected computer as a launching point for further attacks. Data loss is a real possibility if files are deleted or altered, and the compromised machine could also be leveraged to download and install additional malware, compounding the damage. Given its danger rating, users should treat any detection of this threat as a serious security incident.
Signs of Infection
Because Trojans like this one are built to run silently, obvious symptoms may not always be present. However, users should watch for indicators such as unexplained slowdowns, unusual network activity, unfamiliar processes running in the background, security software being disabled unexpectedly, or new files and programs appearing without explanation.
How to Stay Protected
To reduce the risk of infection, users should keep their operating system and all installed software fully updated to close known security vulnerabilities. Avoid downloading programs from untrusted or unofficial websites, and never open email attachments from unknown or unexpected senders, even if the file appears to be an image or video. Maintaining a reputable, up-to-date security solution with real-time scanning enabled, performing regular system backups, and exercising general caution online are essential habits for defending against Trojans like Trojan.MSIL.Krypt.GDE.
Analysis Report
General information
| Family Name: | Trojan.MSIL.Krypt.GDE |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
4a6b93fa2aeb9ee02ad2b6592e3f61e3
SHA1:
5024cc2c60b4dbe93947e682508c58dca24f3fc0
SHA256:
6A227AF911A9516C75602B263CA0639D745BD98D280497FFAB3D98960E2F7563
File Size:
927.23 KB, 927232 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 2.0.4.0 |
| Company Name | VoltX |
| File Description | VoltX |
| File Version | 2.0.4.0 |
| Internal Name | VoltX.dll |
| Original Filename | VoltX.dll |
| Product Name | VoltX |
| Product Version | 2.0.4 |
File Traits
- .NET
- Confuser
- HighEntropy
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,136 |
|---|---|
| Potentially Malicious Blocks: | 33 |
| Whitelisted Blocks: | 433 |
| Unknown Blocks: | 670 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
