Trojan.Kryptik.BTE
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,450 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 54 |
| First Seen: | April 11, 2026 |
| Last Seen: | June 23, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Kryptik.BTE on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malicious software, but without more specific information, it's crucial to understand the general characteristics of such threats and how to address them effectively.
Table of Contents
What Is Trojan.Kryptik.BTE?
Trojan.Kryptik.BTE, as indicated by its name, is likely a form of Trojan horse malware. Trojans are malicious programs that disguise themselves as legitimate software to gain unauthorized access to a computer system. They can be used for a variety of malicious purposes, including stealing sensitive information, installing additional malware, or providing unauthorized access to hackers. The ".Kryptik.BTE" part of the name may suggest specific characteristics or behaviors of this malware, but without detailed analysis, it's essential to focus on general principles of malware removal and system security.
How Trojan.Kryptik.BTE Operates
Typically, Trojans operate by deceiving users into installing them, often by masquerading as useful applications or attaching themselves to legitimate software downloads. Once installed, they can execute a wide range of malicious activities, from data theft and espionage to using the infected computer as part of a botnet for distributing spam or conducting DDoS attacks. Understanding how Trojans operate is key to preventing future infections and removing existing ones effectively.
Symptoms of Infection
Symptoms of a Trojan infection can vary widely depending on the specific goals of the malware. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, or unfamiliar programs appearing on the system. Sometimes, infections may not exhibit noticeable symptoms, making regular system scans crucial for detection. It's also possible for Trojans to create backdoors, allowing hackers to remotely access and control the infected system, which can lead to further malicious activities without the user's knowledge.
How to Remove Trojan.Kryptik.BTE
- Enter Safe Mode with Networking: This will help prevent the malware from loading and make it easier to remove. Restart your computer and press the key to access your boot menu (this varies by manufacturer but is often F12, F2, or Del). Select the option to boot in Safe Mode with Networking.
- Perform a Full Scan with a Reputable Tool: Use an anti-malware tool like SpyHunter to scan your system thoroughly. This can help detect and remove the Trojan and any other malware that might be present.
- Uninstall Suspicious Programs: Go through your installed programs and remove any that you don't recognize or that were installed around the time you suspect the infection occurred.
- Reset Your Browsers: Trojans can often affect web browsers, so resetting them to their default settings can help remove any malicious extensions or settings. This can usually be done through the browser's settings menu (e.g., Chrome, Firefox, Edge).
- Reboot and Re-scan: After taking these steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been fully removed.
Conclusion
Removing Trojan.Kryptik.BTE and preventing future infections require a combination of immediate action and long-term vigilance. By understanding how Trojans operate and taking steps to secure your system, you can protect your data and maintain your computer's integrity. Regular system scans, careful downloading habits, and keeping your operating system and software up to date are key components of a robust defense strategy against malware threats.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.BTE |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
27df57be42c5d660ba75b684570326de
SHA1:
f4f8d793b35300dc4b0cd0ea89de602e1cb1f96c
SHA256:
36F0F2DF9984C03AA01A22A6556F6B8D3F6DCB6D63A95D1DDDE96B3EE9687977
File Size:
2.99 MB, 2988416 bytes
|
|
MD5:
a85de64fefdb605914efc4f1beaff318
SHA1:
b7562b1021d901503f8e372c83dadb16e1913825
SHA256:
1FE9BAB90AB4789FC94BFCCB2D6FDC528F8B372BFA2C80D31DEC8393A599D937
File Size:
2.98 MB, 2984336 bytes
|
|
MD5:
5d6203f606ab06edc6f1cb2b83bc9967
SHA1:
ecf517feb93c86584b24ee16299227e699040ca8
SHA256:
B8F5F2DDE2E6A63F5EB5E00FD68A316F23143E5E01835064407A993536175AAB
File Size:
2.19 MB, 2190008 bytes
|
|
MD5:
12e35406b981d3ebb16a09d6be0a46ce
SHA1:
08e9d599d5ce2a68f234a8c118f28cda3577acbb
SHA256:
F3D33CAC2ECF45D307B5FE601DAD350E769912452716CCA48C73C610EEE34A69
File Size:
2.44 MB, 2438136 bytes
|
|
MD5:
0aad798ba38eb32e3302d41b525b5f1f
SHA1:
6b1f62148f8b7c3e5747eb7adcf5b0ce70387923
SHA256:
B5DA3BC8B69480F9451D00CB298FF2E059299D6933AC3162E2424AE4873C4D1C
File Size:
5.01 MB, 5013712 bytes
|
Show More
|
MD5:
d161b5883aacce4c8cb780bf9390d990
SHA1:
bd877253d1ee06a878b005560e694188ff3e3a43
SHA256:
0DBF64290D57B3CABE9FD7C87296B72024FE232B64869B0DD4AAB98722908CDF
File Size:
3.00 MB, 2998912 bytes
|
|
MD5:
bc1f8080cd02a5949d11beb20a68e2a7
SHA1:
24215c40915fb54c5c2f8a4ee6ed527b1219dfe2
SHA256:
99151C4CF172808440316EFA14F847D406521C62BAB9E6E14D0987921536AEAF
File Size:
2.44 MB, 2438112 bytes
|
|
MD5:
407e289efabe726d0c8c9885a6389198
SHA1:
c8b1504801a9d1ca35d09136fb2066c64744e087
SHA256:
9DDFBE7ED6F04F3397A900D07C2F0FE3EDCF88213A23BBA097B7B0699CED000A
File Size:
4.91 MB, 4910208 bytes
|
|
MD5:
9c4acdeb5c992a98523e6821b888cd5d
SHA1:
360800dc077f85a655634445c182e4018b851d38
SHA256:
29FBE379590D0D8117268C5CA8981E22DA7551256CE22FF1E151867327409898
File Size:
4.65 MB, 4646080 bytes
|
|
MD5:
97e56770068cbb1ee0c025833f801a27
SHA1:
c48702c0963c0bf3cb34819d7dcdb46b12fb1f41
SHA256:
02126FCC68597C33F19FDBB6CA9875F8D3A4ACD2AD9604BF162FFC20F42FF0ED
File Size:
4.51 MB, 4509312 bytes
|
|
MD5:
d647c0e96f02797cd493103640d949b9
SHA1:
889bc3e6258ededb6e931e05913f27476d66dce6
SHA256:
671766846F634CBF303484D3FD76553D015CD30D46B877DCE1D9E81972064A49
File Size:
4.01 MB, 4005056 bytes
|
|
MD5:
64b300aba9546d591d19909783858b9b
SHA1:
f0e25389c56857f6986a936e8d4994aa6e17278a
SHA256:
1630229921B37C6062C9960263D0A0F5FC01F943A267A69D1760BD77F782A94C
File Size:
4.91 MB, 4910208 bytes
|
|
MD5:
614381fab1d5d8497b7625964c4ef6f4
SHA1:
3f89410b9939c3b8c82deef4377335bb9d5c5300
SHA256:
6D3CBCB38F3802C740E2B8AA90B2BF10D8519E2E7F1BA00F3EEEAAB439D53D01
File Size:
6.26 MB, 6263304 bytes
|
|
MD5:
40e9709d32414d3d807e1bd10b12fcee
SHA1:
62dd1edb29a8a905ce413cff28d3dbd5f49973de
SHA256:
6D0082B2B9891B7531B37E5511FB3071112F390A8AF574FD30FF1714314A7DCC
File Size:
3.01 MB, 3008128 bytes
|
|
MD5:
d9c22f8397fd1a06de1dc52483acce3f
SHA1:
51403ff509f1f827f9e3100ca4871546208f4c81
SHA256:
B4A4523F6BFF5F2E2210B460B8A6202BA6E52127313FDEFC2301ADDA814AD7AB
File Size:
2.94 MB, 2941096 bytes
|
|
MD5:
f7dc4555a54be2607f6fe0cf6fbbe8a3
SHA1:
008f5175af8a0b6698b2136b9038bc083e8282e5
SHA256:
B936436BA0C77B0E3314EEA85037F70085270C9A1BCC42B802448AAAF558F2D2
File Size:
3.10 MB, 3103424 bytes
|
|
MD5:
3df28fb0d18f717c797b9bc785d36cad
SHA1:
c289fd84a86817d21cc496bf9e841d724b91adc0
SHA256:
EC7D3A8D66B31308875DF2F6450FFB235173B912030699E0F5C2E0E7FCE48919
File Size:
3.52 MB, 3517096 bytes
|
|
MD5:
aaf3cae6b7caf11761e62feff31a2e73
SHA1:
b017190733a26cbd34d5c4d5f73b00e210e78950
SHA256:
01204E3B31B0B173FFCCCE27E40EBCB6C1C54DEBFA64973B160DD31A819E8795
File Size:
2.86 MB, 2856104 bytes
|
|
MD5:
3e60238be7e1d17e9aa63815ad100de5
SHA1:
878b39c9c8b7268d88bb0ab7dfd98fb94ba84c70
SHA256:
1C99E946FE3BC4CE257E80348A9E0BAB37DB419FBED451C15B348FD2B24145E3
File Size:
3.77 MB, 3767424 bytes
|
|
MD5:
bd96fadd91987b20724889569ca3daa8
SHA1:
c8cc45898bfac2d0c98e85bc432e0ad8003e2475
SHA256:
AF68C0602A4E3FD32C65A5ABD4CAEBD268D40F5FF2B1944A3B074288E0DA75CF
File Size:
4.63 MB, 4633280 bytes
|
|
MD5:
0b27d5450f68cb1de04684252734a695
SHA1:
9ebab75bb5d4c9f1c36eef95d1a5aa544dd5b859
SHA256:
850956DBB3BA7A750AEC62F0BC7971A984B9D62324948E8BE7707838E0EC26B4
File Size:
4.52 MB, 4523200 bytes
|
|
MD5:
1b0cedef083d93d2f4f6277db4872511
SHA1:
8dda1d568456abe3df39f462c80b757d854e2a0f
SHA256:
3B262D3AA26DEE66A0A614417001DF2AC171AC7E5DE198425186480145A48083
File Size:
2.83 MB, 2834136 bytes
|
|
MD5:
eb6522baf5d68a5905e95de5a2bfe367
SHA1:
c74859371021b48e22fa4c73b4edbe037fc76b1b
SHA256:
51C4C37F197DA9D56B5D2952DFD5AA55F5D213A36FDF9E830E48ADA9647B007F
File Size:
3.07 MB, 3070080 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| *.100mensch.de | *.100mensch.de | Self Signed |
| *.issuu.com | *.issuu.com | Self Signed |
| *.merriam-webster.com | *.merriam-webster.com | Self Signed |
| *.rottentomatoes.com | *.rottentomatoes.com | Self Signed |
| *.searchhounds.com | *.searchhounds.com | Self Signed |
Show More
| *.ss.com | *.ss.com | Self Signed |
| drawme.io | drawme.io | Self Signed |
| www-cs-02.oracle.com | www-cs-02.oracle.com | Self Signed |
| www.aa.com | www.aa.com | Self Signed |
File Traits
- big overlay
- dll
- golang
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 11,548 |
|---|---|
| Potentially Malicious Blocks: | 239 |
| Whitelisted Blocks: | 4,329 |
| Unknown Blocks: | 6,980 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.BSA
- Agent.MPF
- Kryptik.BTE
- Kryptik.DZE
- Kryptik.FRS
Show More
- Kryptik.VY
- Rozena.DDB
- Rozena.DDC
- ShellcodeRunner.LLC
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Anti Debug |
|
