Trojan.Kryptik.AAZF

The detection of Trojan.Kryptik.AAZF on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the security and integrity of your computer, allowing unauthorized access and potentially leading to further malicious activities. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.

What Is Trojan.Kryptik.AAZF?

Trojan.Kryptik.AAZF is a type of Trojan horse malware, which is a broad category of malicious software that disguises itself as legitimate programs. Trojans are known for their ability to deceive users into installing them, often by posing as useful applications or hiding within other software downloads. Once installed, Trojans can open backdoors for remote access, allowing attackers to steal sensitive information, install additional malware, or use the infected computer for malicious activities.

How Trojan.Kryptik.AAZF Operates

Trojan.Kryptik.AAZF, like other Trojans, operates by exploiting vulnerabilities in system security or user behavior. It may spread through various means, including but not limited to, infected software downloads, phishing emails, or exploited vulnerabilities in operating systems or applications. Once it gains access to a system, it can perform a variety of malicious actions, including data theft, keystroke logging, and the installation of additional malware. Its primary goal is to remain undetected while it carries out its malicious activities, making it challenging for users to identify and remove without proper security tools.

Symptoms of Infection

Identifying a Trojan infection can be difficult due to its stealthy nature. However, several symptoms may indicate the presence of Trojan.Kryptik.AAZF or similar malware. These include unexpected changes in system performance, such as slow operation, frequent crashes, or unusual network activity. Users may also notice unfamiliar programs or icons on their desktop, unexpected pop-ups, or changes in browser settings. In some cases, antivirus software may detect and alert users to suspicious activity, prompting them to take action.

How to Remove Trojan.Kryptik.AAZF

1. Boot into Safe Mode with Networking: This will help prevent the malware from loading and give you a cleaner environment to work in. Safe Mode starts Windows in a basic state, using a limited set of files and drivers, which makes it easier to remove malware.
2. Perform a Full Scan with a Reputable Tool: Utilize a trusted anti-malware tool, such as SpyHunter, to scan your system thoroughly. These tools are designed to detect and remove malware, including Trojans like Trojan.Kryptik.AAZF.
3. Uninstall Suspicious Programs: Review the programs installed on your computer and uninstall any that you do not recognize or that were installed around the time your system became infected.
4. Reset Your Browser Settings: Malware often targets browsers, changing settings to redirect users to malicious sites or to display unwanted advertisements. Resetting Chrome, Firefox, Edge, or any other affected browser to its default settings can help remove these changes.
5. Reboot and Re-scan: After taking the above steps, restart your computer and perform another full scan with your anti-malware tool to ensure that the malware has been completely removed.

Conclusion

Removing Trojan.Kryptik.AAZF requires careful and systematic steps to ensure that all components of the malware are eliminated from your system. It's crucial to remain vigilant and proactive in maintaining your system's security through regular updates, backups, and the use of reputable security software. By understanding how Trojans operate and taking the necessary precautions, you can significantly reduce the risk of future infections and protect your personal and sensitive information from falling into the wrong hands.

Analysis Report

General information

Family Name:	Trojan.Kryptik.AAZF
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9ea1c727ec62894e2a0a3ad482a00626 SHA1: e58550caaa537addd6b1ef6b6cfd27d0ee1937f9 SHA256: 2B0B53D678585DD49D209CDAFD298BC1A352AA95D5ECD8CCFEA7810F4F16FB58 File Size: 2.26 MB, 2255856 bytes

MD5: 3ce82e63ba79a685f86d68fd3d4fb6e0 SHA1: b98708a6478203cc72a3c443d941a9c91b093d55 SHA256: B9DCC0C1A107C121EC4518733B35964315DA99DFB752C1AD59659F6A1AD42D09 File Size: 3.38 MB, 3375104 bytes

MD5: 91b4da222f84ae620bf09da2e975b524 SHA1: 36419277fc9e187390db722ace8cf8ce3dbc9502 SHA256: EB168647C24D2CD40EFC24B32411D4EB6E86588531DE8D6CC4C9AB2A47954A97 File Size: 3.40 MB, 3395584 bytes

MD5: 94d2649285df98919f54ec9db83f726e SHA1: f8b7e803b2307accca5a570da1ea1686075ee1af SHA256: B032BB18A8A7CEF2F4D0C5BD4F6F44BC3A0CBFCC8A21B1159DC88F9A6024E378 File Size: 2.13 MB, 2129920 bytes

MD5: 65011afcc918d216e1ce346dfea8f51e SHA1: 5e5d87b927d53aabc056ec405deb7e7d5dc8daed SHA256: 8A15D2C035577BEE272422D53AECC9D6AD00AF72490B4B2F441AF12A5BBA579F File Size: 2.58 MB, 2576384 bytes

Show More

MD5: 7ac3e4681848fb87fd3286a30a27526f SHA1: f13f361b22ad02e3e9e20ee9714d3273e601d93b SHA256: 44786769AE4D9B0993B1CFC46C9E729E471DD785C53C79A7F75B2D0569F2ABE3 File Size: 2.23 MB, 2229231 bytes

MD5: d06ce329b54418849b1e5423fba20109 SHA1: aa8f51493850c572e9b210fd8f1362664e192474 SHA256: 356D83BBDC46A0EEC222D7A553EF3803244334E6E09454B2919890DEB39E19D3 File Size: 5.62 MB, 5620224 bytes

MD5: c91e72769d5cc7f145ea5ffebc69a3da SHA1: f2620c0a947eee7f39d148c2ccf6d2a4d8aa791f SHA256: 6EBE0E5BC6223F03D23A74FFEE0D94EB0E95F728DD461B4324DA73E486314F59 File Size: 1.93 MB, 1929216 bytes

MD5: fa3acee055e72a0a99e0ae2c7fea8f2b SHA1: ccce3f2727c21c987b6cddad0cecbcdb4c823a20 SHA256: 2C7A23A9852960E8A52DAFE4C3FCBD132435BA43E19A0A5137265C68F1462EEA File Size: 3.97 MB, 3973120 bytes

MD5: 5d5b36d49bde91dcd86e3a9eccfb07e5 SHA1: 977936bf2ba41f29e0746316a33e75c6c26db757 SHA256: D682CF51164E300C650710AE762D49ABDF033A93AD2F39B8703ECC912E458AB9 File Size: 2.06 MB, 2057626 bytes

MD5: 065d7e95bedd4f76e7ff7e6a54c8a10f SHA1: 3f842dd978dfa3f300f4b9c73f8ad74522e5bd47 SHA256: 2F9547D1E9D14E4F498FBCFB1F832708A5071C66A2186D996F22395F645416B3 File Size: 4.74 MB, 4743168 bytes

MD5: 340521df671998264d929d6b3224b504 SHA1: 11c3eb8a8b7c9fe0e54bf5f74dd6b7bb1d18986e SHA256: 8D3E9B6C861E05AEB77699CCC21AE95397E2CA5BF4244C2EFF409ECAFA1CE754 File Size: 2.61 MB, 2613248 bytes

MD5: aa98b4d2811b173a2c35a455ce7451d8 SHA1: 282fd2435e74535bbb6c64d9b06a9bb8e61b07e0 SHA256: D2D9397E75F42F050CE252477F62AF6E2BDB6E859BBB8909373EDC1A44CA7389 File Size: 2.54 MB, 2539520 bytes

MD5: e3826557138f9223e572a1f1a6e4cfcc SHA1: a54a0342cf891d90b5cf7966702f73de207a2135 SHA256: 3B52E7E9F857952DFC3107FB084E6009742B008CFE44E2723E7F47F9F8A1557A File Size: 6.60 MB, 6598656 bytes

MD5: 12f353653149556bd930c3fa78c3685b SHA1: de2a1c17be72204837bd577ab6d0a48b40618c90 SHA256: 0246AA2C10BD026B98D9BDB7095854A158AD98E4707DC69FADCCEE55F0F48A62 File Size: 5.90 MB, 5902336 bytes

MD5: 7c1d29ad278a82af5b40eab47929e66e SHA1: eb1985c04cc9f3094bf2826af7b868794c490b62 SHA256: 1B20767B50A7B21FB35A86C92557B5C3F0D26CBF8511C3FDC98FB4B48B11FD35 File Size: 6.06 MB, 6061493 bytes

MD5: 263fcff6c130a607cf6316716de6b6fb SHA1: 7974f5e9cb366d5cf8a15e9b237ff2cad0cdc054 SHA256: E500C0650D0E1213F976D26FE4BDED851551FC5D00E87592CEA7FCB3EFB56D55 File Size: 5.81 MB, 5812224 bytes

MD5: 2c7e9c2651d904ad7a3b8d4737dfe80a SHA1: 33b3cf335a0c825b5f2325a5bffdfb029411f03d SHA256: 93F4D9678008236A534CB7893594C8914756E22A5EA95DBB39024A13146DBFC4 File Size: 6.20 MB, 6201344 bytes

MD5: 8d8b302a0cf2d3ec6bd921a8056c928a SHA1: ebdfb5ac60989002090001d67c394b3e86b8ae9f SHA256: DF917737CDFBB036EEFEC51E98082061EB30240841A120AF4B636BC3F6FEEBED File Size: 2.52 MB, 2519040 bytes

MD5: 23cdff6b29542b5790154a36d7602ac7 SHA1: a538dc68219cf43b59a0bd1622ebbbc81c434035 SHA256: 3B033D653E94C88029FFE2A09F7D8925AD37DD9F4209557166E67FC83CCD10AE File Size: 1.36 MB, 1363968 bytes

MD5: ee30e482ab94b08f933b7e8b6575add5 SHA1: 1ded16f1789208feb7675149517f606c49d9e760 SHA256: 2CDE12857D17151DEFC3D4EA6ABA94B7D82C76C4233EB7E503ED6FCB0104E2A2 File Size: 4.79 MB, 4792320 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
00.0	D
Assembly Version	0.041..
Company Name	BellSoft BlueStack Systems MaresWEB Microsoft Corporation Oracle Corporation The Qt Company Ltd.
File Description	BlueStacks Sensor Native Library C++ Application Development Framework EULA ffdshow WMV9 HRWaw.SkinEditor.Design Microsoft® C Runtime Library OLE DB Simple Provider OpenJDK Platform binary OptimFROG add-on for the BASS library
File Version	96.0.20080.0 (WinBuild.400002.9700) 80.64.88000.0 built by: REL 70.0.00001.0 (WinBuild.094060.8370) 13.020.9.00 8.8.3000.0 7.035.00.4000 2.4.0.2 0.2a 0.1.0.0 0.09.2.0
Full Version	13.020.9.00 8.8.3_000-b00
Internal Name	abtfwar.dll ATNN BASS_OFR ejyth hnqvtdl.dll HRWaw.SkinEditor.Design.dll llhcu120.dll to_ete9
Legal Copyright	2003-2006, MaresWEB Copyright (C) 2017 The Qt Company Ltd. Copyright 2011 BlueStack Systems, Inc. All Rights Reserved. Copyright © 2021 Copyright © 2022 Copyright © 2007 © Microsoft Corporation. All rights reserved.
Legal Trademarks	GNU GPL
Original File Name	HD-Sensor-Native.dll
Original Filename	abtfwar.dll atnn.dll bass_ofr.dll ejyth.dll hnqvtdl.dll HRWaw.SkinEditor.Design.dll llhcu120.dll oatlderkdkrltabsidbht.dll to_ete9.dll
Product Name	Abtfwaranta Inztohe\sot Ghwihheqd ST AeetPdsxsl Atnn(ES) Frikhzoe DN 8 H321 BASS_OFR EjytHLU Twskecue 8 Hnqvtdlwl\emf Cendoon\let Vbttjtthf O IPDev.SkinEditor.Design Llhcueroc ll Teokes Deealyso Oa5 toreteh LTD9
Product Version	80.64.88000. 8.8.3000.0 7.035.00.4000 2, 4, 0, 0 1.3.0209.0 0.2a 0.1.0.0 0.09.2.0
Froduct Version	70.0.00001.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
The Qt Company Oy	DigiCert SHA2 Assured ID Code Signing CA	Hash Mismatch

File Traits

• 2+ executable sections
• dll
• HighEntropy
• imgui
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	193
Potentially Malicious Blocks:	7
Whitelisted Blocks:	158
Unknown Blocks:	28

Visual Map

? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 2 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 1 2 0 0 0 0 0 0 0 1 1 0 0 1 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 1 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 ? ? x ? x 0 ? ? ? ? ? ? ? x ? ? ? x ? ? ? x ? x ? 0 ? ? x 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Autoit
• Delf.Q
• Kryptik.AAZF
• Philadelphia.A
• Philadelphia.B

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\autbef0.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\windowsloader.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\windowsloader.exe	Generic Write,Read Attributes

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtProtectVirtualMemory Show More ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetThreadState
Process Shell Execute	CreateProcess
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
Process Manipulation Evasion	NtUnmapViewOfSection
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState
Network Winsock2	WSAStartup

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e58550caaa537addd6b1ef6b6cfd27d0ee1937f9_0002255856.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b98708a6478203cc72a3c443d941a9c91b093d55_0003375104.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\36419277fc9e187390db722ace8cf8ce3dbc9502_0003395584.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f8b7e803b2307accca5a570da1ea1686075ee1af_0002129920.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5e5d87b927d53aabc056ec405deb7e7d5dc8daed_0002576384.,LiQMAxHB

Show More

C:\Users\Rhcnwlwn\AppData\Local\Temp\WindowsLoader.exe

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f2620c0a947eee7f39d148c2ccf6d2a4d8aa791f_0001929216.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ccce3f2727c21c987b6cddad0cecbcdb4c823a20_0003973120.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3f842dd978dfa3f300f4b9c73f8ad74522e5bd47_0004743168.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\11c3eb8a8b7c9fe0e54bf5f74dd6b7bb1d18986e_0002613248.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\282fd2435e74535bbb6c64d9b06a9bb8e61b07e0_0002539520.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a54a0342cf891d90b5cf7966702f73de207a2135_0006598656.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\de2a1c17be72204837bd577ab6d0a48b40618c90_0005902336.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7974f5e9cb366d5cf8a15e9b237ff2cad0cdc054_0005812224.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\33b3cf335a0c825b5f2325a5bffdfb029411f03d_0006201344.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ebdfb5ac60989002090001d67c394b3e86b8ae9f_0002519040.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a538dc68219cf43b59a0bd1622ebbbc81c434035_0001363968.,LiQMAxHB

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1ded16f1789208feb7675149517f606c49d9e760_0004792320.,LiQMAxHB