Trojan.MSIL.Krypt.MAD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,849 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 17,098 |
| First Seen: | July 1, 2021 |
| Last Seen: | July 19, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.MSIL.Krypt.MAD indicates that a potentially malicious program has been identified on your system. This type of threat is generally categorized as a Trojan, which is a broad term for malware that disguises itself as legitimate software. Trojans can have various functions, including data theft, system compromise, and malicious activity execution. It's essential to understand the nature of this threat and take prompt action to remove it and prevent further damage.
Table of Contents
What Is Trojan.MSIL.Krypt.MAD?
Trojan.MSIL.Krypt.MAD is a type of malware that can infiltrate your system through various means, such as exploited vulnerabilities, phishing attacks, or drive-by downloads. The name itself does not provide specific information about its functionality or origin, but it suggests that it may be related to data encryption or obfuscation. It's crucial to note that malware authors often use misleading or confusing names to evade detection and make removal more challenging.
How Trojan.MSIL.Krypt.MAD Operates
Once installed, Trojan.MSIL.Krypt.MAD can operate in the background, potentially without visible symptoms. It may communicate with command and control servers to receive updates, transmit stolen data, or execute malicious commands. The malware can also spread to other parts of the system, infecting files, and compromising system integrity. Understanding the operational methods of this malware is vital to developing an effective removal strategy.
Symptoms of Infection
Systems infected with Trojan.MSIL.Krypt.MAD may exhibit various symptoms, including slow system performance, frequent crashes, and unusual network activity. You may also notice unfamiliar programs or processes running in the background, or find that your system settings have been altered without your consent. However, some malware can operate without noticeable symptoms, making regular system scans and monitoring essential for early detection.
How to Remove Trojan.MSIL.Krypt.MAD
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for internet access. This will make it easier to download and install removal tools.
- Perform a full system scan using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of the malware. Ensure that the tool is updated with the latest definitions to improve detection accuracy.
- Uninstall any suspicious programs that were installed around the time of the infection. Be cautious when removing programs, as some may be legitimate or required by your system.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings that the malware may have altered.
- Reboot your system and perform another full scan to ensure that all remnants of the malware have been removed. This step is crucial to verifying that the removal was successful and that your system is clean.
Conclusion
Removing Trojan.MSIL.Krypt.MAD requires a thorough approach to ensure that all components of the malware are eliminated. By following the steps outlined above and maintaining good system hygiene, you can reduce the risk of reinfection and protect your system from similar threats. Regular system scans, keeping software up-to-date, and being cautious when interacting with unknown sources are key practices in preventing malware infections. Remember, the detection and removal of malware are ongoing processes that require vigilance and the use of reputable security tools.
Analysis Report
General information
| Family Name: | Trojan.MSIL.Krypt.MAD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
32977c6bec4c531ebca58c052f60a92b
SHA1:
24a969d5dea0b13e2069cfcf0e8a7d3892700b2c
File Size:
1.57 MB, 1565184 bytes
|
|
MD5:
2c48576d595ef87d9ca1842b05044e5a
SHA1:
8dd5b7bdd42369c629edea40a6ab992ba5cfb3c2
SHA256:
7C2C4D36795AD943C7E33E1AB63820698497E78357AB606E3DFF27C3EF299A40
File Size:
1.40 MB, 1402368 bytes
|
|
MD5:
8190a9ad00741bb884a1e1141ea45c30
SHA1:
80cd18065341c6a1e461a93ca62d69dcfaafa31e
SHA256:
C5192171930618F2BCC7CA6CC2761314368A31281A3B8A0D8A4457118A6ED08B
File Size:
517.63 KB, 517632 bytes
|
|
MD5:
4ca12f066ddf27c049f1e17c05a2fb77
SHA1:
2d4d7350c59f65f3a8c4ec58e3e8d6807b99c852
SHA256:
C71B496D6DFF3B073CC3F81725A19DF26B31E65D7D675D79F8C4DD83E2CA4C2E
File Size:
1.63 MB, 1629184 bytes
|
|
MD5:
ed983ed246ac613b278095bf546d3fad
SHA1:
44e725b06c102ec0d19e23121763f30a30cacf4f
SHA256:
3AC852E687D7C848B9534ABE7B11835C7C324F121614B70F84264B4E4751B438
File Size:
285.70 KB, 285696 bytes
|
Show More
|
MD5:
f0f76810036cbabc7fcb81060ece6d66
SHA1:
8dc3c74988db94dbf60258171583cba1df2cd906
SHA256:
5D0BA70C44CE41CB5A4C88E51173016CBDFF2721D901758AAFC43484D27F4967
File Size:
168.45 KB, 168448 bytes
|
|
MD5:
ea85b4837db12c1a0fbcda1af8844935
SHA1:
82fa7faca6bb51c7b076361a4cdfd997165c215b
SHA256:
EA0C13E3C0351BA3DC665C484DD4282356AA4401414BEFC8E59431CBB30CA4CC
File Size:
1.46 MB, 1455616 bytes
|
|
MD5:
a9a914ad24c08a2ad97af8d104d82953
SHA1:
32fb89a7cac411208e48903965bb80415cffa1d6
SHA256:
25290F26511126DD26B91C9DF13200DA2529BDF719AAB99019D1CB07336778BD
File Size:
1.46 MB, 1461248 bytes
|
|
MD5:
4c6afe3ff1ba770205065f43e8f45875
SHA1:
813296a048e162a80dcc5b74c1bd93e5a97bce92
SHA256:
BB65D59DFFD0F7039E5D3B69432F9A0FCF41C57FFFED4CFF06A429B39E7B681C
File Size:
609.28 KB, 609280 bytes
|
|
MD5:
ac79d0ee9ccb1f07b0d51ad38bb23205
SHA1:
e1f14f4d0e3cda9391677e38f96d336a1316d03b
SHA256:
0540491F7949758B2E4EF50E7189EF01D01543EF40CFFC897DC09C26F36ED606
File Size:
1.40 MB, 1400832 bytes
|
|
MD5:
0b9ca2671c895f053aa38505c924452c
SHA1:
c53b8a788bc316e3fe54546ccfc5a44c4893d9d7
SHA256:
309F8055A722F24798686AE9B28F00299DF8B087C5195AC752F220FCCC52D9C1
File Size:
379.90 KB, 379904 bytes
|
|
MD5:
6f25f2a052e9eb72967948877e14f108
SHA1:
4722b0e6666a58110b57be26993e5b60042d3b65
SHA256:
C65722E8046EFF2ABA6AF3AFF578BB70D40D12D55EEBBDCB7365E7C977D0678B
File Size:
629.25 KB, 629248 bytes
|
|
MD5:
3200799fe620539e04eb59acc99afa96
SHA1:
49f4b8ab24ddca85b4ea1e4438c8f16ac3c2af25
SHA256:
C3BFAB4BF62D249B7F316D6B70BD5750DF3A7A9C70421D08C733823D703E4AB2
File Size:
499.71 KB, 499712 bytes
|
|
MD5:
509a1f923465b35e3f9a99950bb108ba
SHA1:
566864ab8deadcf691928e58a6747758de973461
SHA256:
E66054C8C04646B923DAFABD3D5C552F2DC67FDC6FE396A9748EC15550CC9442
File Size:
1.20 MB, 1196544 bytes
|
|
MD5:
b1868321ed254e3fc0d062f742a7f81f
SHA1:
be23ee40df5f1f69a083a360bb7ac2b475ff8e91
SHA256:
49632E2979845594BFB4D1756A411A565ECF32B8480558FD197F1DF7DF67C44E
File Size:
1.67 MB, 1672704 bytes
|
|
MD5:
91e79d21737feb5de45819e8fbe9c29c
SHA1:
6e9e5c96792e3c699b63b3cc46e1acdc132eefa1
SHA256:
9167327D8B16A3AAE2B9229CF0AF0029ECEF102DF369FCFEBAC4FE29F9316E18
File Size:
669.70 KB, 669696 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
Show More
|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- .NET
- HighEntropy
- Installer Version
- msil.krypt
- NewLateBinding
- ntdll
- RijndaelManaged
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 837 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 830 |
| Unknown Blocks: | 6 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Agent.HGC
- MSIL.Agent.JI
- MSIL.Agent.XY
- MSIL.CsdiMonetize.VQ
- MSIL.CsdiMonetize.WB
Show More
- MSIL.CsdiMonetize.WD
- MSIL.Krypt.GEEVA
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\volumetrica trading::proxymode | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Keyboard Access |
|
| Other Suspicious |
|
