Trojan.MSIL.Krypt.ZADD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,085 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1,844 |
| First Seen: | January 15, 2022 |
| Last Seen: | March 14, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Krypt.ZADD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
22a3c557d469862250d862310541479b
SHA1:
5959a140d956dead99f3b5079c747d1f20c1a34a
SHA256:
E10B2D653E07097AF1935A3A24ADB92560A32B118862D6465C5A8564B4402E63
File Size:
189.70 KB, 189696 bytes
|
|
MD5:
df2787eaa74b7b3903f77a6cbeaf6c97
SHA1:
ec0ef391c2f5c9e91edd266531ed65c3aa16f4ac
SHA256:
3BF9A10BE29889E8963830CCF8DFC54E377C766CE6E0B16BC8D5EE5080FCC707
File Size:
182.78 KB, 182784 bytes
|
|
MD5:
e7d6437b6da811b26faacdd695de0b54
SHA1:
1608abb67bfdc29ec31c083835e9721f233c5654
SHA256:
1AF6996A085859F9FC9F868477288D94884BB946ADC0456B354822233ECE7F52
File Size:
204.68 KB, 204684 bytes
|
|
MD5:
85db3dac75448149f61ba326ca05e96d
SHA1:
fc04f04ffd819dbd0f1f7d65a8a8983fb0b7a8ff
SHA256:
4E5562C53E41483BC2AE584A2A8F6C87AE6C43F2AA035631C47DA2DC224935AC
File Size:
340.99 KB, 340992 bytes
|
|
MD5:
c39216ac483dab1dea94e3810c62ab1e
SHA1:
2cdccb66ddc828f4dcf980d8fa0a78c9e3665bbb
SHA256:
A41F173F71574479E8769B03242C3AEBEAD3EF5D63283FFA9A450179D66D08B6
File Size:
155.65 KB, 155648 bytes
|
Show More
|
MD5:
bbc840bc13b1e203c746c3d6ea9da4b8
SHA1:
449187e3fe0eb9adaac118ac87ebaf95867379b0
SHA256:
FE97AC17A7D95FD0668B1A26CEB14D29A49542A6346B924FC5E22D908C913794
File Size:
4.23 MB, 4233814 bytes
|
|
MD5:
68f9fea4b5558c9e13b4c73c412ebc1b
SHA1:
d827ae9b6591cfe49abb578d663e460a84b146b0
SHA256:
F02C2BA99B69A6C0BE58EC0EED006A8B8C61A8A8BC3A60FC0775CB813B23C2C9
File Size:
279.55 KB, 279552 bytes
|
|
MD5:
517189b2389625dcdfba5fea18603f26
SHA1:
d06dd7bd0e63baeb5725a60147232f9bb101097f
SHA256:
13EB22D7B2979484D8DEC8220749C41063A31FB90A4E431D65FCBC9E69F72766
File Size:
202.75 KB, 202752 bytes
|
|
MD5:
bac8cd3c67b43777fd9e82a05fdae2cd
SHA1:
0656d3d417b621b54bd60e9cd149623b6cd4a153
SHA256:
F27F48903D3D4966B98D38F08AEC95704E097F338153777339B1CA9832551C8A
File Size:
4.21 MB, 4205382 bytes
|
|
MD5:
4e83f200987936f9c8a05d972fbe328c
SHA1:
8aec87a38f40c7809d52a90ac16274c0a43449ec
SHA256:
188395F5A1F886B4EFF366F678D00E8E519E5267D8E9CB7809297816EA68E4EC
File Size:
276.99 KB, 276992 bytes
|
|
MD5:
0788feecd759de779577782d160a8955
SHA1:
b9c65116dbd044a42af0cab2ec48a4f5c7ba3534
SHA256:
FFB813E7E59C0B8A184748F3E98BD47EE2E4851626C2749A1B94A3673DA2B312
File Size:
230.91 KB, 230912 bytes
|
|
MD5:
41d6dd6a4b1506900a23980474b6cc22
SHA1:
c2b066111aa452c59e1d05629bc941df48be2d82
SHA256:
768F47CDB0E3DCD99B70DD83DC408A948ED5362B83302B73524ACA3D8E50F8B0
File Size:
214.02 KB, 214016 bytes
|
|
MD5:
e7c0b4b59b605841af035a438990ed83
SHA1:
cb513f6fa3dc68d73c97259b204bc907d5778af7
SHA256:
ADCF4CC9C7D3DD678294D82EE5FEE49D4036E0191E65CE9C0BB1B85A5FA1BC15
File Size:
418.22 KB, 418217 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
Show More
|
| Product Version |
|
File Traits
- .NET
- CryptoObfus
- HighEntropy
- Installer Version
- RijndaelManaged
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Agent.DFYA
- MSIL.Agent.YJ
- MSIL.ArchSMS.A
- MSIL.Coinminer.AK
- MSIL.Downloader.DNHH
Show More
- MSIL.Downloader.Tiny.FG
- MSIL.Downloader.Tiny.RF
- MSIL.Downloader.Tiny.UA
- MSIL.Downloader.XC
- MSIL.Dropper.SEA
- MSIL.Gamehack.G
- MSIL.Keylogger.BF
- MSIL.Krypt.GDOG
- MSIL.Krypt.MBJY
- MSIL.Krypt.RDC
- MSIL.Mardom.AM
- MSIL.Patcher.E
- MSIL.Perseus.AI
- MSIL.Redline.LA
- MSIL.Redline.RC
- MSIL.Redline.RD
- MSIL.Spy.DH
- MSIL.Spy.DO
- MSIL.Spy.RG
- MSILZilla.PL
- Sabsik.D
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-r67ts.tmp\0656d3d417b621b54bd60e9cd149623b6cd4a153_0004205382.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi20dc.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nslc4f7.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nslc4f7.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nslc4f7.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsn20fc.tmp\dmr.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsn20fc.tmp\nsexec.dll | Generic Write,Read Attributes |
Show More
| c:\windows\appcompat\programs\amcache.hve | Read Data,Read Control,Write Data |
| c:\windows\appcompat\programs\amcache.hve | Write Attributes |
| c:\windows\assembly | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\software\microsoft\tip\aggregateresults::data | 隞̃☁耀꧌ Ў Ȯ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
5 additional items are not displayed above. |
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
| Other Suspicious |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Phmtfauj\AppData\Local\Temp\nslC4F7.exe"
|
C:\Users\Ksptcnkg\AppData\Local\Temp\nsn20FC.tmp\dmr.exe /a /e 12869173 /u 08b0e20b-f140-11e3-8a58-80c16e6f498c /lp "c:\users\user\downloads\1608abb67bfdc29ec31c083835e9721f233c5654_0000204684"
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 860
|
"C:\Users\Uigamkgs\AppData\Local\Temp\is-R67TS.tmp\0656d3d417b621b54bd60e9cd149623b6cd4a153_0004205382.tmp" /SL5="$60348,3953769,58368,c:\users\user\downloads\0656d3d417b621b54bd60e9cd149623b6cd4a153_0004205382"
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 880
|
