Trojan.Kryptik.BFSC
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,369 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 38 |
| First Seen: | May 21, 2026 |
| Last Seen: | July 1, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Kryptik.BFSC on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malicious software, but without more specific information, it's crucial to understand the general characteristics of such threats and how to mitigate them. In this report, we will guide you through the nature of this threat, its operational methods, symptoms of infection, removal procedures, and conclude with recommendations for securing your system.
Table of Contents
What Is Trojan.Kryptik.BFSC?
Trojan.Kryptik.BFSC, as indicated by its name, is likely a form of Trojan horse malware. Trojans are malicious programs that disguise themselves as legitimate software to gain unauthorized access to a computer system. They can be designed to perform a wide range of harmful actions, from stealing sensitive information to disrupting system operation. The specific capabilities and intentions of Trojan.Kryptik.BFSC are not detailed here, but understanding that it's classified as a Trojan helps in grasping the potential severity of the threat.
How Trojan.Kryptik.BFSC Operates
Trojans typically operate by deceiving users into installing them, often by masquerading as useful applications or piggybacking on legitimate software downloads. Once installed, they can create backdoors for remote access, allowing attackers to control the infected system, steal data, or use the system for malicious activities like spamming or launching attacks on other computers. The exact operational methods of Trojan.Kryptik.BFSC are not specified, but it's essential to be aware of these common tactics to protect against future infections.
Symptoms of Infection
Symptoms of a Trojan infection can vary widely depending on the malware's design. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, or frequent crashes. You might also notice unfamiliar programs or toolbars in your browser, changes to your homepage, or an increase in spam emails being sent from your account. Since Trojans can be designed for stealth, some infections may not exhibit noticeable symptoms, making regular system scans crucial for detection.
How to Remove Trojan.Kryptik.BFSC
- Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download necessary tools while restricting malware activity.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure your antivirus software is updated to the latest version to increase the chances of detecting and removing the threat.
- Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only remove programs you are certain are malicious or unnecessary.
- Reset your browsers (Chrome, Firefox, Edge, etc.) to their default settings. This can help remove any malicious extensions or changes made by the Trojan.
- Reboot your system and perform another scan to ensure the malware has been fully removed. Repeated scans can help confirm the system's cleanliness and detect any remnants that might have been missed initially.
Conclusion
Removing Trojan.Kryptik.BFSC requires a systematic approach to ensure the malware is completely eradicated from your system. By following the steps outlined above and maintaining vigilance through regular system scans and safe browsing practices, you can protect your system from similar threats in the future. Remember, prevention is key, so always be cautious when downloading software, avoid suspicious links, and keep your operating system and security software up to date.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.BFSC |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
50211a8293149b81d0a1a91dfffa2057
SHA1:
294c72994e2364bd1b00172a401752cbf2fd2934
SHA256:
28A01B9C28C240905C76C438E9254BEAB19CF4CF10461C7D2EAFC424133200B4
File Size:
1.98 MB, 1979008 bytes
|
|
MD5:
dbf92549ba6116ba7a0d42e24b7d07be
SHA1:
9331b59a50bc7d8ed990646a88d535e79b72253b
SHA256:
D008969533EFEA27DC9DED7D2F75715698257094EDC4B455E4E213E01EF7C22F
File Size:
2.43 MB, 2430592 bytes
|
|
MD5:
f57f20b963978d298a7173c756153105
SHA1:
a0af69e07b70fb5739829401321bd19d7e79ef4d
SHA256:
754705B56629E4CE14A3396C344A97D4433083F92439DB3560BBA24168DF4661
File Size:
2.69 MB, 2692224 bytes
|
|
MD5:
5d0496e138bae3e70ea9985cd9e4ecf4
SHA1:
6dd40f3f28dfceadaf94cddcc0f69dcad0831e88
SHA256:
0BD9D46A323470A96146724AC4A7D0C71B351033139F05B74DB79560CB0F2047
File Size:
1.89 MB, 1894528 bytes
|
|
MD5:
802003dd67eb1e1721b31a81c3fd91d4
SHA1:
020013ca204517816736694407c7f2266849b2a3
SHA256:
B99FB8EF08E2F8156662845BA79BACF25203B677C7F87A56517B94EB86A9767A
File Size:
2.48 MB, 2482304 bytes
|
Show More
|
MD5:
93ab034ec20f7511b2f408f3102ff602
SHA1:
69a0f191773fabbdc8fd012e0adc7f61878ede92
SHA256:
438357B014446C0561D8A897D88565A6D1D33B4C310A2696B9D6BBB3F5D3F8A5
File Size:
2.30 MB, 2301056 bytes
|
|
MD5:
eef2fa496bdfbd3274908096e6f024ce
SHA1:
27fe7feb89f59f8b9baf5c654c82ad11c23c1356
SHA256:
66C5389F7434AAC947CA7F90327B2973CD51226CD35DCF6D3363BEE9AF9BF768
File Size:
2.63 MB, 2627720 bytes
|
|
MD5:
a3bbd5375b4184729687e02245977cea
SHA1:
9df5d769918a284c904069f8432d238232b21708
SHA256:
B5DA4E81610C1A380ED478CD81FF8960CA6102E5A5CB8A67622E52CE2D3FEC02
File Size:
2.65 MB, 2654856 bytes
|
|
MD5:
fcf8f11748c96bf1a0e4e76388f53833
SHA1:
203f93f7db22551fc6d0c80d1403544d366a3a92
SHA256:
BD7832157BC4CCFF2632E3E457D47042FDDD8327A72549F1DDA6BB822C85F04F
File Size:
6.51 MB, 6509184 bytes
|
|
MD5:
bc99288d8dcee988d64ba758a4818e8e
SHA1:
197678caf964f8f5a56468bfaf5277cecaeb757d
SHA256:
2D12FF35A429AE8D4174B07AD0CE20ACCC3DA346AAB8CBE772D0DC35938C6CBF
File Size:
2.56 MB, 2558592 bytes
|
|
MD5:
b3751ed861ec8ff488eaa55af5587e7b
SHA1:
f48493f1a83e730d8ee2e74e64be606719292992
SHA256:
E613B9A2F12E2FB758A99835F5D3B0E43F6DCC1E34B13E73AE201691A5DA9151
File Size:
2.40 MB, 2396808 bytes
|
|
MD5:
b89d8e918dddeb55e3f90c61b71652a7
SHA1:
284c3d1dc9087dbf45cb0f5084784d4ebc6c935a
SHA256:
CF155086AF96BB0BFE0487C54639EFD643E7052A67BA81B95140F528E9199756
File Size:
3.04 MB, 3036808 bytes
|
|
MD5:
338b487de251789741114de49313860d
SHA1:
b402928f01094d73d2dc6cc2f65bb079c3168ba0
SHA256:
4C10758F15098EE92689836CBBF72E3201F3113C1ADAC31711C3F6E6D8A1BBAC
File Size:
2.09 MB, 2089984 bytes
|
|
MD5:
3ffcd576ff53f7ca83fe1687f499d487
SHA1:
1b166af2bc857aa7603bef3cce1f7bed0bf89b71
SHA256:
BADCCCA2356C5DD483DABCA27A52EFA5FED97E66B9500310705750C120B9BA89
File Size:
1.84 MB, 1838208 bytes
|
|
MD5:
74fa72e77effbcbc020f5eb71427fe3d
SHA1:
a77d6fb36af3c20c1daa4c3c79b2a69452962e45
SHA256:
0B5B5C70F1CBBF7D47318F0A49505D07EF9B86E4C812E39F9AD47210F6AE80AE
File Size:
3.15 MB, 3154568 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| avinc.com | avinc.com | Self Signed |
| cpcalendars.zewa.com | cpcalendars.zewa.com | Self Signed |
| godaddy.com | godaddy.com | Self Signed |
| me.muz.li | me.muz.li | Self Signed |
| privatebin.info | privatebin.info | Self Signed |
Show More
| quiverquant.com | quiverquant.com | Self Signed |
| vm.bit.hosting | vm.bit.hosting | Self Signed |
| www.agrarheute.com | www.agrarheute.com | Self Signed |
| www.sjabr.org | www.sjabr.org | Self Signed |
File Traits
- big overlay
- dll
- golang
- HighEntropy
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,521 |
|---|---|
| Potentially Malicious Blocks: | 11 |
| Whitelisted Blocks: | 2,490 |
| Unknown Blocks: | 20 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Adaptix.B
- Agent.BSA
- Agent.KTSD
- Agent.MPF
- Agent.MPM
Show More
- Agent.MYS
- BadJoke.KGB
- Kryptik.BFSC
- Kryptik.BTE
- Kryptik.FRS
- Kryptik.FRSA
- Kryptik.FRSD
- Kryptik.GDSY
- Kryptik.GOA
- Kryptik.VY
- MSIL.Brute.TT
- Quasar.LD
- Quasar.SB
- Quasar.TBA
- Rozena.DDB
- ShellcodeRunner.LLC
- ShellcodeRunner.LWA
- Trojan.ShellcodeRunner.Gen.FZ
- Trojan.ShellcodeRunner.Gen.KT
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �m �vT�����(�(X�1`1�1HO @V� H[u_�zb"hk`k�q{b��P� ������ �������.�m� Ù� ����$�8წ�� �=�SB1_ T�Vw���%������ �AE��D��&��$���L | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Network Winhttp |
|
