Trojan.Downloader.NI
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 0 |
| First Seen: | April 23, 2026 |
| OS(es) Affected: | Windows |
Trojan.Downloader.NI is a heuristic detection name assigned to a family of malicious Windows binaries whose defining job is simple and dangerous: reach out to the internet and pull additional malware onto an already-compromised machine. Unlike a self-contained payload, a downloader is a beachhead. It is small, quiet, and disposable, and its real damage arrives in the second stage it fetches after it lands.
Because Trojan.Downloader.NI is a behavioral and structural signature rather than the badge of one branded crimeware kit, the specific binaries it flags rotate constantly. The sample analyzed here is a 64-bit Windows library that queries network configuration, speaks to remote hosts over WinHTTP and Winsock, employs anti-analysis tricks, and touches encryption routines — a profile consistent with a modern loader or downloader component.
Table of Contents
What Is Trojan.Downloader.NI?
Trojan.Downloader.NI belongs to the broad trojan-downloader class of malware. A trojan-downloader installs itself on a system and then, once connectivity is available, contacts an attacker-controlled server to retrieve and execute further payloads — which can be information stealers, banking trojans, ransomware, cryptominers, or backdoors. Security vendors including F-Secure, Malwarebytes and Kaspersky document this category as one of the most common initial-access mechanisms in the wild, precisely because it decouples the initial infection from the eventual payload.
The ".NI" suffix indicates a specific heuristic variant identifier within the vendor's downloader taxonomy. It is important to be candid: Trojan.Downloader.NI does not map cleanly to a single, publicly documented, branded malware family (such as Emotet, Zloader or GuLoader). In the analyzed bundle the only related label returned was "Downloader.NI" itself, at roughly 84% similarity, which confirms this is a coherent generic cluster rather than a rebrand of a named actor's kit. The guidance below therefore describes the concrete, measured behavior of the analyzed sample plus well-established public knowledge of how trojan-downloaders operate, without attributing it to any specific threat group.
How It Spreads / Distribution
Trojan-downloaders in this class typically arrive through the same vectors that dominate commodity malware distribution. The most common are malicious email attachments and links — weaponized documents, archives, or script files delivered under a plausible business pretext that rely on social engineering to get the user to open them. They are also frequently dropped by a separate trojan-dropper as part of a multi-stage chain, bundled with cracked or "free" software from untrustworthy download portals, seeded through malvertising and fake update prompts, or delivered by exploit kits targeting unpatched browsers and plugins.
Because the analyzed artifact is a DLL rather than a standalone EXE, it is likely designed to be loaded by a host process — for example via a legitimate executable vulnerable to DLL search-order hijacking, a rundll32/regsvr32 launch, or side-loading alongside a signed application. That library-based delivery is a deliberate evasion choice: it lets malicious code run inside the context and reputation of a trusted process.
Technical Analysis & Behavior
Dynamic analysis of the representative sample surfaced a cluster of behaviors that together paint a clear picture of a network-capable loader with evasion built in. The binary is a 64-bit Windows DLL that resolves and leans on ntdll, the lowest-level user-mode interface to the Windows kernel. Consistent with that, the sandbox flagged direct syscall use — invoking native system services directly rather than through the higher-level, commonly-hooked Win32 APIs. This is a well-known technique for slipping past userland EDR and API-monitoring hooks.
The sample also exhibited anti-debugging behavior, indicating it checks for analysis environments and can alter or halt execution when it believes it is being watched. It performed user-data access, process termination, and made use of encryption routines — the latter typical of loaders that decrypt an embedded configuration or an inbound payload, or that encrypt outbound data. Multiple "other suspicious" heuristics fired alongside these.
Its networking footprint is the heart of the downloader role. The sandbox recorded network configuration queries plus use of the Winsock, Winsock2 and WinHTTP stacks — the standard building blocks for establishing sockets and issuing HTTP(S) requests to a remote server. In a downloader, this is the machinery used to check in with command infrastructure and stage the next-stage binary. During execution the sample modified on the order of 15 registry values and 10 files, activity consistent with establishing persistence and dropping or staging content on disk.
Indicators of Compromise
The following indicators come from a single analyzed sample of Trojan.Downloader.NI. Treat them as a representative snapshot: values reflect one analyzed sample, and specific indicators such as hashes rotate from build to build, so the absence of these exact values does not mean a system is clean.
- MD5: e94827070624a3145bc927b14d57391e
- SHA-1: 299f4f6181bcfeac62e8ad501ff8a3e89ddb90e6
- SHA-256: C8A356806867F42B1FC72DD0FE89DEFDEC9BC876BE15822EF30777776E43CE9A
- File size: 280,064 bytes (~274 KB)
- File type: 64-bit Windows DLL (references ntdll)
- Digital signature: none — the file carries no valid Authenticode signature (unsigned)
- Packers: no known packer identified by the analysis engine
No command-and-control IP addresses, domains, or URLs are asserted here — the analyzed bundle did not capture verified network endpoints, and inventing them would be misleading.
Detection Heuristics
Antivirus and EDR engines flag samples like Trojan.Downloader.NI through a blend of static and behavioral heuristics rather than a single hard signature. On the static side, telling attributes include an unsigned 64-bit DLL of modest size that imports and resolves ntdll directly, an anomalous PE structure (the analysis noted roughly a dozen notable PE characteristic flags), and the absence of the metadata a legitimate library would normally carry. Direct-syscall stubs and encrypted/high-entropy regions are additional static red flags.
On the behavioral side, engines score the combination that this sample demonstrated: anti-debugging checks, direct native-API invocation, enumeration of network configuration, outbound WinHTTP/Winsock activity, process termination, and clusters of registry and file modifications shortly after load. No single one of these is conclusive, but their co-occurrence in a small unsigned library is a strong classifier for a downloader/loader — which is exactly what a heuristic label like ".NI" encodes.
Digital Forensics
Investigators triaging a suspected Trojan.Downloader.NI infection should hunt across several artifact classes. On disk, look for the analyzed hashes above and for a recently created unsigned ~274 KB 64-bit DLL in user-writable or temp locations; the sample modified around ten files during execution, so review recently written executables, DLLs, and staged data near the initial artifact's timestamp.
In the registry, the sample altered roughly fifteen values — examine the common persistence keys (Run/RunOnce, services, scheduled-task registrations, and any COM/CLSID or AppInit/DLL-loading hijack points) for entries that reference the suspicious library or an unfamiliar host process. In memory and process telemetry, watch for a trusted process (for example rundll32, regsvr32, or a side-loaded signed application) making unexpected outbound HTTP connections via WinHTTP, or issuing raw Winsock traffic, together with signs of direct syscalls and anti-debug probing. Correlate network logs for first-time-seen outbound connections originating shortly after the DLL was loaded. Because this family rotates hashes and endpoints, prioritize the behavioral pattern — unsigned DLL, ntdll/syscall usage, network staging, persistence writes — over any single static indicator.
Symptoms of Infection
Trojan-downloaders are engineered to be quiet, so overt symptoms are often subtle until the second-stage payload lands. Warning signs include unexplained outbound network activity or spikes in bandwidth, a trusted system process making connections it never made before, new or unfamiliar startup entries and scheduled tasks, unexpected files appearing in temp or profile directories, sudden performance degradation, security software being disabled or crashing, and the later appearance of entirely different malware (stealers, ransomware notes, cryptominers) that the downloader fetched.
How to Remove Trojan.Downloader.NI
Because Trojan.Downloader.NI can pull additional payloads that persist independently, remove it promptly and then hunt for what it may have installed. An automated, up-to-date anti-malware tool is the most reliable approach.
- Disconnect from the internet to cut the downloader off from its command infrastructure and stop further payload retrieval.
- Run a full system scan with SpyHunter. Install or update SpyHunter, then launch a complete (not quick) scan so it can inspect running processes, loaded DLLs, the registry, scheduled tasks, and disk. Let it quarantine and remove every detected component, then reboot and scan again to confirm the system is clean.
- Boot into Safe Mode with Networking if the threat resists removal or reloads on startup. In Safe Mode fewer third-party modules load, making it easier for the scanner to delete a locked DLL and its persistence entries. Re-run the full scan from Safe Mode.
- Remove persistence manually (advanced users only). Using the forensic pointers above, delete malicious Run/RunOnce entries, rogue services, and scheduled tasks, and remove the offending DLL and any staged files. Do not delete registry keys unless you are confident they are malicious.
Clean Up Affected Browsers
If a fetched payload tampered with your browsers, reset them:
- Google Chrome: Settings → Reset settings → "Restore settings to their original defaults." Then review Extensions and remove anything unfamiliar.
- Mozilla Firefox: Help → More troubleshooting information → "Refresh Firefox." Review installed Add-ons afterward.
- Microsoft Edge: Settings → Reset settings → "Restore settings to their default values," then audit Extensions.
- Android: In Chrome for Android, clear the browser's storage under Apps settings, remove any recently installed suspicious apps, and run a reputable mobile security scan.
After cleanup, change important passwords from a known-clean device — a downloader may have installed a credential stealer — and ensure Windows and your applications are fully patched.
Conclusion
Trojan.Downloader.NI is best understood as a delivery mechanism rather than a final payload. The analyzed sample — an unsigned 64-bit DLL that uses direct syscalls, resists debugging, queries the network stack, and communicates over WinHTTP/Winsock while writing to the registry and disk — embodies the classic loader playbook: get in quietly, evade analysis, and stage whatever comes next. Because it is a generic heuristic cluster with rotating indicators rather than a single branded family, defenders should lean on the behavioral fingerprint and remove it quickly with a full anti-malware scan, then investigate the machine for the additional malware it may already have pulled down.
Analysis Report
General information
| Family Name: | Trojan.Downloader.NI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e94827070624a3145bc927b14d57391e
SHA1:
299f4f6181bcfeac62e8ad501ff8a3e89ddb90e6
SHA256:
C8A356806867F42B1FC72DD0FE89DEFDEC9BC876BE15822EF30777776E43CE9A
File Size:
280.06 KB, 280064 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,487 |
|---|---|
| Potentially Malicious Blocks: | 174 |
| Whitelisted Blocks: | 1,313 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.NI
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134267470742698921.9360.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_lit25zaf.ypt.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_mqhzliod.204.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\debug.log | Read Attributes,Synchronize,Read Control,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 㟲ꊄǝ | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
34 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Network Info Queried |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Process Terminate |
|
