Trojan.Kryptik.HGAA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 636 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 2,819 |
| First Seen: | July 24, 2024 |
| Last Seen: | July 10, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Kryptik.HGAA on your system indicates a potential security threat that requires immediate attention. This report aims to provide you with a comprehensive understanding of the threat, its operational mechanisms, symptoms of infection, and most importantly, steps to remove it from your system. It's crucial to approach this situation with caution and follow the recommended procedures to ensure the security and integrity of your data and system.
Table of Contents
What Is Trojan.Kryptik.HGAA?
Trojan.Kryptik.HGAA is identified as a Trojan-type threat. Trojans are malicious programs that disguise themselves as legitimate software but actually allow unauthorized access to a computer. They can be used to spy on users, steal sensitive information, or gain control over the infected system. The name "Trojan.Kryptik.HGAA" suggests it may involve encryption or stealth capabilities, but without specific details, it's essential to focus on general removal and protection strategies.
How Trojan.Kryptik.HGAA Operates
Trojans like Trojan.Kryptik.HGAA typically operate by deceiving users into installing them. This can happen through various means, such as opening malicious email attachments, downloading software from untrusted sources, or visiting compromised websites. Once installed, the Trojan can perform a variety of malicious activities, including data theft, keylogging, or even allowing remote access to the infected computer. The exact operation of Trojan.Kryptik.HGAA would depend on its specific design and the intentions of its creators.
Symptoms of Infection
Symptoms of a Trojan infection can vary widely. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, or programs starting automatically. Some Trojans may also cause issues with internet connectivity or lead to the installation of additional malware. However, some Trojans are designed to be stealthy and may not exhibit any noticeable symptoms, making regular system scans crucial for detection.
How to Remove Trojan.Kryptik.HGAA
- Enter Safe Mode with Networking: Restart your computer and enter Safe Mode. This will limit the malware's ability to interfere with the removal process. Ensure you have an internet connection to download any necessary tools.
- Conduct a Full Scan with a Reputable Tool: Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove the Trojan and any related malware.
- Uninstall Suspicious Programs: Check your list of installed programs for anything suspicious or unfamiliar and uninstall it. Be cautious and ensure you're not removing essential system software.
- Reset Your Browser Settings: If your browser (such as Chrome, Firefox, or Edge) has been affected, reset its settings to their defaults. This can help remove any malicious extensions or settings changes made by the Trojan.
- Reboot and Re-scan: After completing the above steps, reboot your computer and perform another full scan with your anti-malware tool to ensure all traces of the malware have been removed.
Conclusion
Removing Trojan.Kryptik.HGAA requires careful and systematic steps to ensure your system is thoroughly cleaned and protected. It's also a reminder of the importance of preventive measures, such as keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading or installing new programs. By following the removal steps outlined and maintaining good cybersecurity practices, you can protect your system from future threats and ensure the security of your personal data.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.HGAA |
|---|---|
| Packers: | UPX! |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6929f99b2e73ba036b49281116e53f67
SHA1:
17ca8951f056375ddbec7640dc97cddfbb44028f
SHA256:
86CAAD5212B0C98D7BD9BF4E4AADD0B69EFAD1008B993A81B947F1989AED0B70
File Size:
79.36 KB, 79360 bytes
|
|
MD5:
3d066c20fe6e60b8594b9e59e719c59e
SHA1:
a45faa24460ed3bf9feaa20e4270520c60bd0a6b
SHA256:
A67F090D61A465981D90CE1D53E57E757D02A58593C70DFFF34F211474AEA808
File Size:
10.75 KB, 10752 bytes
|
|
MD5:
d2c9adb526fe58900d42e425e76b1ae8
SHA1:
4ff9d9cd5c4fc35fe411061ba3289a705db2ae31
SHA256:
38300F25A467B98FAE88DA7B93EA7183E5A96BF7EE313EC5007DEE72AE28092F
File Size:
72.28 KB, 72280 bytes
|
|
MD5:
4c9626223d36e55f5ec7defdde5f5559
SHA1:
b67ff91aa9ddb6bb72d3da977a88c2ae6acb2ea6
SHA256:
F5F60D233007D7CA9DB5DEA29742E176DE1510FCF953AE1A1EC96F3C90895582
File Size:
8.85 MB, 8852755 bytes
|
|
MD5:
59abe0b44b208e578311bd503dffade8
SHA1:
0854accd15a2124c4eab8895ef8834eb6f914425
SHA256:
9E261094A6B5C8E44B45665DAE06C89A7DF90FD12B10BC5F464A6BAC8FCD7958
File Size:
9.22 KB, 9216 bytes
|
Show More
|
MD5:
5a73cd789321ef199d4cf53d21ad21bb
SHA1:
8281434e0af2d47a31d8ad09754f2ac86c756b5b
SHA256:
5F3D745DB74EACBD1DD3C18F3F96794DC5E566C992294C0F29799E16178CAE81
File Size:
32.45 KB, 32448 bytes
|
|
MD5:
67091acb3b6193e7ccc77a405273bc1e
SHA1:
5216323a2405d06ee0f12c8a33d88ed7e7c149a0
SHA256:
48BD2800A40AECE92452191336BB64D5400B1B1DCA7D2AE82D404AF8A1B636C5
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
efb2d6ec4be92e71ca2427d962463aca
SHA1:
0692fd84e77efe37c0407b6a56923c1cb6afd166
SHA256:
7B4F8E1F1B10876B82AEB48F44D8A498546952A74B7E5D08F90FCE5E19BE38D9
File Size:
15.87 KB, 15872 bytes
|
|
MD5:
a8c219de419a8f1b57e95b391576ce81
SHA1:
61e18c6aa4a0152da3bc65cf3adecd2b61745087
SHA256:
201D3D61DC5E1FA0DC884C91C0C9C58E25B869EBFC75B88F9DCFB2F013EAE1A2
File Size:
4.23 MB, 4231083 bytes
|
|
MD5:
61e18b9073418b4055061db295ba3a0f
SHA1:
0cf8dda3dd05551f9bbdeaf74d5da065bcd7700b
SHA256:
1BC19E9E848A0B964474FABFE8B12BDE8B4D29554FB26F6DDA86C1C94F82FDB7
File Size:
8.04 MB, 8036353 bytes
|
|
MD5:
e0a84e2e4b8fdafc20194bdb1dcb8a6a
SHA1:
0fa0eba2a88f21f988458908902085b10c986f68
SHA256:
6E224EC4E294EDC581EE653A748AFC40C836FF9224C91D3FCCC90AC597B16F86
File Size:
11.78 KB, 11776 bytes
|
|
MD5:
f5f577da8cdf6b4824bc1fe23329d235
SHA1:
e2c85b8050602fc59cb60f28539699688004f455
SHA256:
C9AE1AB3B9624DB21C1CEDD05C4605EB5E76F52E40F6BFA1F2E2D2CDB1B857E3
File Size:
519.02 KB, 519016 bytes
|
|
MD5:
ecf3521162620802f82b24345d4dac36
SHA1:
bb6b042d90db459f9e5247c8f10d78fb7bb9655c
SHA256:
CBD37CA1D3FD112F1582F36EF6DD0F5760727AD1A3E6A9EAE3E8F560B938AB6C
File Size:
5.62 MB, 5620097 bytes
|
|
MD5:
4a0bc97fd440886d4648d876d8c66261
SHA1:
91b496034af047ca3e450582d7c068b169b40943
SHA256:
914936CF7F9A9191BDBD606B2E2B64901EF392AD6AC42BCBACFA0503BC48D5F0
File Size:
93.18 KB, 93184 bytes
|
|
MD5:
c7d1cdb9ff0338dd5deb435d97afef41
SHA1:
9e3bae4e52a86ec06d0631343b77fd83336d5848
SHA256:
CD91903B55D772177163F2E38507021CE47C654D0308A3C1871717513E64589F
File Size:
22.36 KB, 22360 bytes
|
|
MD5:
8ec526717656c2827d86b56badfbdf79
SHA1:
7b8e14d46999f44811e5d1dedffcbd7fd359e9de
SHA256:
445277240E2D9AD40E2A5EEE9F486EFF2D4E05CF713E67CBC6EA10CEBCBD4805
File Size:
11.26 KB, 11264 bytes
|
|
MD5:
7f2b5653606e7618d76cd0ac23fd6a9d
SHA1:
829983f0fa276a694dd11c3bd6467323255879b5
SHA256:
2BF8659CF016A89D2CDBE42B8497CC13247FBDECC6207D4D38E1F34F078554CF
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
5b6dc17e914c1fe3164435f7edc53f62
SHA1:
fb58d50a0807893d5271c93731dc8901732b38f3
SHA256:
AFB924FF41DF707A964AEACB383324576C654BC9DC5193D248B411F1275C752D
File Size:
2.24 MB, 2240204 bytes
|
|
MD5:
346ffc7bb4dda718573247b133af1dff
SHA1:
228ce915acb3a7690aa6b2a812e3dc209323985f
SHA256:
9C5D370B8E4419FF07D9C172431859BA1AC0C446881ADC4B09669EB9BCEB11B9
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
9aeac4c3280605e9008c0a3642c22292
SHA1:
ace879dcdf77054ff3babb399b5ade1da4c443dc
SHA256:
9FC26E4431F4887949E6C5F99135EEE31212A59814E6653260449460DC9A8A63
File Size:
15.13 KB, 15128 bytes
|
|
MD5:
071dd05351151ecb39f5655e8fee7d6e
SHA1:
ae5d4c5b54ada42547ff2ba4009dc0aabcb36d62
SHA256:
242760121F67D5467197BBBB96D52038010F00DDA9D0FE1F79ACD786ED6F7935
File Size:
15.13 KB, 15128 bytes
|
|
MD5:
a6475b34c424f18c83616e09e6c9fb45
SHA1:
8fa7bd9d46953096ed2fe9126a2fe9b9f53722e3
SHA256:
15F4FA5E8A112472125041E1DB143A155AD57A64B0CF5AD5C0755C782A427569
File Size:
14.34 KB, 14336 bytes
|
|
MD5:
fec4f533603e0e7b9d1e445c1834211d
SHA1:
f1d11c9aa40e9c5e6d328209fc173477f02ac190
SHA256:
0B68B641EA1FCE1F652F55F3C5015C4672CAA6813D0CD80C4A1FAD771CC775BF
File Size:
79.19 KB, 79192 bytes
|
|
MD5:
c62c6b070bd164acddfc0f56e581d33b
SHA1:
8aa429bcd7f0b8ee2c8f060292f72631a46f0a54
SHA256:
5CC0D1C8F8062F7CD0C1992B3C404D6B3221238E936A5DFDB3A51B7FE7DA5EA6
File Size:
12.90 KB, 12896 bytes
|
|
MD5:
fefad08cd9fe4a005b3eb0462ffd970a
SHA1:
0f50fb4ef69002dc0ebeed3b407cb4240e7d40ed
SHA256:
7D3F51B7A13432B4A1F5FC55FC9E5F35A5DB66DAE5660A41490AD235969788B1
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
557ff8cea9520ca41751118621421449
SHA1:
b6cab2c998257e8302a6a831b08469fc310f41e8
SHA256:
194AB2E895DF38BA14951DAED9F71E75F53AB3202F3F67A7A76696C2A44BBEFF
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
201de9e0ab01c05f10ae931814ffbb8f
SHA1:
6b3425603311cd0be82fd79091e4149a21209aba
SHA256:
86471B6D37BFF36A976FF8FD3FD6A35480DDCCCF4C6DACBDD6015AC0A747B211
File Size:
12.29 KB, 12288 bytes
|
|
MD5:
9da70c4256e0353f5640de3a36da61af
SHA1:
4d4d0a963f7e252317c81c37bf4f8faedd577e8e
SHA256:
C4FA158CA75C5F1C494EBF28FD74CF4C34E4DABE64F90B088F7EA1FFBCA653F1
File Size:
64.00 KB, 64000 bytes
|
|
MD5:
afafb64d81cd2f4b62865f51b7d9ce99
SHA1:
aed35c3aff83417536cef12fcf68d7d23ae010bc
SHA256:
1976B436D24C57A0E9B5ADA2CD0EF81C632B0DEC5071BE989E1D3F487B5D18EF
File Size:
9.91 MB, 9913461 bytes
|
|
MD5:
65e1b21cc913081f9504826c66e836e2
SHA1:
97d4caec2f94dd8ded250ad53af84cef571bfb0a
SHA256:
A1DF0FBD41F6C22E4BCE786DDE7B98CC3F958C2BBCDF9418DAA51B2CCD3B5070
File Size:
7.19 MB, 7189078 bytes
|
|
MD5:
1c09e6906b7f0187f3f4f0141cebb43c
SHA1:
b3b71bab3b9dbdcfbc1303bd26e56b8349e97fc1
SHA256:
FFC75BA2E18C878CB8A0CBBB39DBC9A804CEB26509118C4E0FB096982CA2CE6A
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
2851671ff29110e58fc2e45a865122bd
SHA1:
0adebea97583aefac0f9452a91f5781d3936d919
SHA256:
1E68C5267AA03C52530ED6B93907F56D6A2F5EE227ACDD68053CC107078C2ED7
File Size:
12.29 KB, 12288 bytes
|
|
MD5:
d130f5749f1ed7f2769f20a3275a4961
SHA1:
68d819646cb5a6cec768eb315771bcb30ccf3751
SHA256:
3BE0E82FE252624C2F63E6F9C81CF4825F64175A1C521170C89C47E12DEDDAF0
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
7a3a88a47cba1f4d5db4f54a3b37ec0e
SHA1:
7eafe0c648a1c1d31ad13ad70deec9f0471d9253
SHA256:
D3922D43DAEF0FBB44AD775DC35638145E31B9AF4CF6BA15F1ADE32EAEF40313
File Size:
146.94 KB, 146944 bytes
|
|
MD5:
23654b6e93cc9282df5ae3a94f960f5a
SHA1:
835a0a95224a6cdbb7838ff03bf3165c1e3981fc
SHA256:
5167E09159F41DA9EA6BCE3398D7738C5DFDE5B371A4FEB0A3E5DD6CD238B824
File Size:
4.60 MB, 4601344 bytes
|
|
MD5:
b5ca9545c9ea209fc37737760d16d5f5
SHA1:
b00c10dcb8e0056c91d72707f8fbf1c6dff06a37
SHA256:
31BFA4BEAA08A077AD917567D4DE7936D42383207C865E950FB6F6307190DA55
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
06f9e8d802389bd32191845d71988979
SHA1:
d5e50cd0b3c726e0b4768cbbbaee914e49832374
SHA256:
43C973646AFEAFA1C0DFBAF5278D71DD6F1A2BCE6E9A3150595605C7042E69E3
File Size:
33.28 KB, 33280 bytes
|
|
MD5:
90fe073f0ff12fa7d6093427910b2891
SHA1:
88676ba23afa7537fb58262f07befb97620e0609
SHA256:
C0519C1B932177187D2D9BB44C5A79BECDD1C37364DC4F5435EF94294F71FA80
File Size:
3.43 MB, 3426344 bytes
|
|
MD5:
09034afc5c28ae33e3cb59cce908f926
SHA1:
d70039b13530a1d326a318f25537f2d3c8708a53
SHA256:
815A62CDD9E933D23B3A57A125753F1C1509076CAF1C345879DA1C1139B3EADD
File Size:
33.28 KB, 33280 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is 32-bit executable
Show More
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Build Number | 0 |
| Build Date | Xxx Xxx dd dddd hh:mm:ss |
| Build Type | release |
| Build Version | 62.490293 |
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Languages | English |
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| Original Filename |
|
| Product Name |
Show More
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Biztree Inc. | Go Daddy Root Certificate Authority - G2 | Hash Mismatch |
File Traits
- 2+ executable sections
- dll
- HighEntropy
- Installer Version
- ntdll
- packed
- upx
- UPX!
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 432 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 427 |
| Unknown Blocks: | 5 |
Visual Map
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Banker.U
- Crack.M
- Dialer.GB
- Downloader.Agent.U
- Emotet.CDA
Show More
- Injector.FSB
- Injector.XG
- Kryptik.HGAA
- Small.BB
- Trojan.Downloader.Gen.RP
- Trojan.Injector.Gen.AZR
- zBot.ENA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\a389112f-4a10-4f18-a7d3-cbd37d79df2b | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\_swissknife\ai_arc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\_swissknife\template.aia | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\_swissknife\valuetransformer.zip | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\btd62f9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-4rlpn.tmp\fb58d50a0807893d5271c93731dc8901732b38f3_0002240204.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-fhs41.tmp\61e18c6aa4a0152da3bc65cf3adecd2b61745087_0004231083.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\is-pps0o.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\arial.ttf | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\arialbd.ttf | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\ciulib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\clicked.wav | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\eqdefault.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\maskslib\botva2.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\music.wma | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\pckr.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\selected.wav | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\tahoma.ttf | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-pps0o.tmp\tahomabd.ttf | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-r0ihg.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-r0ihg.tmp\pckr.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-unkrm.tmp\bb6b042d90db459f9e5247c8f10d78fb7bb9655c_0005620097.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vannv.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-vannv.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-vannv.tmp\b2p.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vannv.tmp\botva2.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vannv.tmp\innocallback.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vannv.tmp\isdone.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vannv.tmp\ismyfont.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\setup log 2025-11-09 #001.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\##10.200.31.10#amas::_labelfromdesktopini | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | -k 8��8tXz��B�8 �6 �v z 5� �Z xy �� T�B� ������ � ���� �5����ee +��Bx �< 5 � �!wz "Wc#�#��$kF$�� %"�%:� %�&� &�x(�(X�)�`*J*9*�^*�h+�[,��/9� /��0P%1`1�1HO | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Keyboard Access |
|
| User Data Access |
|
| Other Suspicious |
|
| Network Wininet |
|
| Network Winhttp |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\17ca8951f056375ddbec7640dc97cddfbb44028f_0000079360.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a45faa24460ed3bf9feaa20e4270520c60bd0a6b_0000010752.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4ff9d9cd5c4fc35fe411061ba3289a705db2ae31_0000072280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0854accd15a2124c4eab8895ef8834eb6f914425_0000009216.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8281434e0af2d47a31d8ad09754f2ac86c756b5b_0000032448.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5216323a2405d06ee0f12c8a33d88ed7e7c149a0_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0692fd84e77efe37c0407b6a56923c1cb6afd166_0000015872.,LiQMAxHB
|
"C:\Users\Ivyoqgaw\AppData\Local\Temp\is-FHS41.tmp\61e18c6aa4a0152da3bc65cf3adecd2b61745087_0004231083.tmp" /SL5="$90320,3570768,506368,c:\users\user\downloads\61e18c6aa4a0152da3bc65cf3adecd2b61745087_0004231083"
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0fa0eba2a88f21f988458908902085b10c986f68_0000011776.,LiQMAxHB
|
"C:\Users\Ienpazoy\AppData\Local\Temp\is-UNKRM.tmp\bb6b042d90db459f9e5247c8f10d78fb7bb9655c_0005620097.tmp" /SL5="$D0266,4760352,780288,c:\users\user\downloads\bb6b042d90db459f9e5247c8f10d78fb7bb9655c_0005620097"
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\91b496034af047ca3e450582d7c068b169b40943_0000093184.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9e3bae4e52a86ec06d0631343b77fd83336d5848_0000022360.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7b8e14d46999f44811e5d1dedffcbd7fd359e9de_0000011264.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\829983f0fa276a694dd11c3bd6467323255879b5_0000033280.,LiQMAxHB
|
"C:\Users\Wrstnvvt\AppData\Local\Temp\is-4RLPN.tmp\fb58d50a0807893d5271c93731dc8901732b38f3_0002240204.tmp" /SL5="$801E6,1606566,345088,c:\users\user\downloads\fb58d50a0807893d5271c93731dc8901732b38f3_0002240204"
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\228ce915acb3a7690aa6b2a812e3dc209323985f_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ace879dcdf77054ff3babb399b5ade1da4c443dc_0000015128.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ae5d4c5b54ada42547ff2ba4009dc0aabcb36d62_0000015128.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8fa7bd9d46953096ed2fe9126a2fe9b9f53722e3_0000014336.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f1d11c9aa40e9c5e6d328209fc173477f02ac190_0000079192.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8aa429bcd7f0b8ee2c8f060292f72631a46f0a54_0000012896.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0f50fb4ef69002dc0ebeed3b407cb4240e7d40ed_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b6cab2c998257e8302a6a831b08469fc310f41e8_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6b3425603311cd0be82fd79091e4149a21209aba_0000012288.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4d4d0a963f7e252317c81c37bf4f8faedd577e8e_0000064000.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b3b71bab3b9dbdcfbc1303bd26e56b8349e97fc1_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0adebea97583aefac0f9452a91f5781d3936d919_0000012288.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\68d819646cb5a6cec768eb315771bcb30ccf3751_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7eafe0c648a1c1d31ad13ad70deec9f0471d9253_0000146944.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b00c10dcb8e0056c91d72707f8fbf1c6dff06a37_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d5e50cd0b3c726e0b4768cbbbaee914e49832374_0000033280.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d70039b13530a1d326a318f25537f2d3c8708a53_0000033280.,LiQMAxHB
|
