Trojan.MSIL.Krypt.DAOI
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 25,931 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 1 |
| First Seen: | March 28, 2026 |
| Last Seen: | September 25, 2026 |
| OS(es) Affected: | Windows |
Trojan.MSIL.Krypt.DAOI is a Trojan horse threat that targets Windows computers. As its name suggests, it is built using the Microsoft .NET (MSIL) framework and is typically obfuscated, or "crypted," to help it slip past security scanners undetected. Like other members of the Trojan category, it installs itself quietly, without any clear consent from the user, and can grant attackers significant control over an infected system.
Table of Contents
What Trojan.MSIL.Krypt.DAOI Does
Once active on a system, Trojan.MSIL.Krypt.DAOI behaves in a manner typical of this threat category. It may run hidden processes in the background, modify system settings, and attempt to establish a connection with a remote server controlled by cybercriminals. Through this connection, attackers can potentially issue commands to the infected machine, deliver additional malicious payloads, steal sensitive information, or manipulate files on the system. Because the malware is encrypted or packed, it is specifically designed to make detection and analysis more difficult for security tools, which can allow it to persist on a device for extended periods before being noticed.
How It Usually Gets Onto Computers
Trojans like this one commonly spread through deceptive means rather than exploiting direct system vulnerabilities. Typical infection methods include malicious email attachments disguised as invoices, documents, or other seemingly legitimate files; bundled downloads from untrustworthy websites; fake software updates; cracked or pirated software; and links shared through phishing messages or compromised advertisements. Users are generally tricked into opening or executing the infected file themselves, often because it is disguised to look harmless or urgent.
Risks for the User
The presence of a Trojan such as this one on a computer poses serious risks. Because this threat category can grant attackers broad control over a compromised machine, victims may face stolen passwords and personal data, unauthorized access to banking or online accounts, installation of additional malware, corrupted or deleted files, and disruption of normal computer operations. Given its danger level, users should treat any detection of this threat as a serious security incident requiring prompt attention.
Signs of Infection
Trojans are designed to operate stealthily, so infections are not always obvious. However, users may notice warning signs such as:
- Unexplained slowdowns or freezes, especially when no demanding programs are running
- Unusual network activity or unexpected data usage
- New or unfamiliar processes visible in Task Manager
- Security software being disabled or unable to update
- Unexpected pop-ups, error messages, or system setting changes
- Programs crashing or behaving erratically without explanation
How to Stay Protected
To reduce the risk of infections like Trojan.MSIL.Krypt.DAOI, users should avoid opening email attachments or clicking links from unknown or unexpected senders, download software only from official and trusted sources, keep the operating system and all applications updated with the latest security patches, and use reputable, up-to-date security software capable of detecting and removing Trojans. Regularly backing up important files to an offline or separate location also helps limit the damage if an infection does occur. Staying cautious and skeptical of unsolicited downloads remains one of the most effective defenses against this type of threat.
Analysis Report
General information
| Family Name: | Trojan.MSIL.Krypt.DAOI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0eef9097cfccdbac1a553455fda5e5da
SHA1:
4795806f226771c0c96a227e931d31b93bf5b2ee
SHA256:
374B5D358E19CA3947A257B8A721E76F5A3724C320B7C65EC556D88B48277712
File Size:
1.14 MB, 1141248 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 3.2.5.148 |
| Comments | Advanced system optimization and update management tool |
| Company Name | NexaSoft Technologies Ltd. |
| File Description | Core System Engine |
| File Version | 3.2.5.0 |
| Internal Name | bsN.exe |
| Legal Copyright | © 2026 NexaSoft Technologies. All rights reserved. |
| Legal Trademarks | Nexaâ„¢ is a registered trademark of NexaSoft |
| Original Filename | bsN.exe |
| Product Name | Nexa Update Manager Pro |
| Product Version | 3.2.5.0 |
File Traits
- .NET
- HighEntropy
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 153 |
|---|---|
| Potentially Malicious Blocks: | 86 |
| Whitelisted Blocks: | 67 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Krypt.DAOI
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Anti Debug |
|