Trojan.MSIL.Kryptik.KC
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Kryptik.KC |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
3fc8f7890e9b49b80f634c4b1bb3bc51
SHA1:
f59fcffb4fffc3998741dc0a7fbb059cc9621cf8
SHA256:
C5E4E62CDB2A54A97D46808E32AB66F889634339B72DE7B874A1487F9E421EB4
File Size:
367.10 KB, 367104 bytes
|
|
MD5:
99a168afd3503d4844764711052928a8
SHA1:
905ce4111dfbcc916997bb6bf00f5715eea51f5f
SHA256:
CEB5BE2B0FC3E3CCFBAAB8EF90FB02D3EFD17DDA1BCF349810CC9195EBD7B74F
File Size:
378.88 KB, 378880 bytes
|
|
MD5:
3af27e41d59e0dbe93614db0d898c8dd
SHA1:
9cccc991dab31329a60ac60803e8f2da4ac3caa1
SHA256:
9E6BE5D1E3558F62300B8FF8C7BC71D82F0DCFE33ED1BB57F52585426B61BEA7
File Size:
289.79 KB, 289792 bytes
|
|
MD5:
16c9d374af6f98a2b4bb09b6cdd5a403
SHA1:
61a6c2f708ea47c0ea6e228f4c0fc7e577e9f0ef
SHA256:
2BB042E30AA39B73A2A6E7DE5EDC4F6E4F83D2FB370E418FC96F663F7862E17B
File Size:
377.86 KB, 377856 bytes
|
|
MD5:
2235e2586b8a6fa31609cf6d783c0d1d
SHA1:
8c8e98ee6c203a400f7f06b213f298470f905ace
SHA256:
4442BA4C60A6FC24A2B2DFD041A86F601E03B38DEAB0300A6116FEA68042003F
File Size:
678.91 KB, 678912 bytes
|
Show More
|
MD5:
14894f093fb6d1a9dbf68df69506a665
SHA1:
17229f46a96639920b8e8ee311b7cb138ff86080
SHA256:
C11282743C579DFDC692AEE2D928CB6E349B39A3E0B3E80A2846667014613825
File Size:
377.34 KB, 377344 bytes
|
|
MD5:
372aa0df84cd96fa51ba593ffd19d0f6
SHA1:
6ccc77c83b3ddec386f1c39ff962425b4ee45082
SHA256:
2FBBCE8D7EA938FCB654018A9ED26A03527ACBDEDC76936D55FA7493C0BBD02C
File Size:
377.34 KB, 377344 bytes
|
|
MD5:
a544d9f927d52f5c8d825c3eb43c3431
SHA1:
051eec90d0d522a3b9f66db61960697c925c16a3
SHA256:
C1054DACFA5844DE7A43A8D9DDB723DE3316902C9FD890FD3DEFF38AE072AA0E
File Size:
377.86 KB, 377856 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| File Version | 1.0.0.0 |
| Internal Name |
|
| Original Filename |
|
| Product Version | 1.0.0.0 |
File Traits
- .NET
- GenKrypt
- HighEntropy
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 10 |
|---|---|
| Potentially Malicious Blocks: | 5 |
| Whitelisted Blocks: | 1 |
| Unknown Blocks: | 4 |
Visual Map
x
x
?
?
x
x
?
x
0
?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134124444053903184.4636.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134134090979908270.2420.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134141372082452370.6840.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134167399834636809.5012.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134203464612692611.4740.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_1d0hs2ii.0qx.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_1yvpl23k.141.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_3b0xfjsf.kuk.ps1 | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\__psscriptpolicytest_4wmhvnq1.s04.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_g3ho2cng.4hb.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_kvkyutxz.5fp.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_lbwpcnol.sxz.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_nhe2vwfh.oql.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_nrpjwrhm.br0.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_sp5c33pe.pnk.psm1 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 蒅봨訾ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 㛹±郞ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 榮ྞꢊǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ♊௦쥗ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Syscall Use |
Show More
|
| Network Winsock2 |
|
| Network Winsock |
|
