Trojan.MSIL.Krypt.GJLD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 2,774 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 106 |
| First Seen: | October 13, 2025 |
| Last Seen: | April 30, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Krypt.GJLD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
31e275e5be67394935d3bc5645c9e9b9
SHA1:
e326b276e37dd141c9cc85201f338ca63623e5ca
SHA256:
F905525C7CCC65679C0AE5D2709F189D3686B31CA087687C665A1E4D849DDB16
File Size:
645.12 KB, 645120 bytes
|
|
MD5:
deb6a84e4407b9dc630d097399723337
SHA1:
0356a228c569a14ed0fd0bdfbb7ee9e287061626
SHA256:
E695E4B61AD27CDF59C13E839D04D2EC9782FB9521ABF97371BCD14D90D223FB
File Size:
969.73 KB, 969728 bytes
|
|
MD5:
59296a21c5f9d89c59606577be4413d4
SHA1:
70288821ec0ca3adac055a5b5bc11091d3962603
SHA256:
92340A2808BF87AEF8620CB9B2399B7D62282BBC43682C63289517C849AE3B60
File Size:
646.14 KB, 646144 bytes
|
|
MD5:
37d7aeb4bc68e2eab6b7921698c17776
SHA1:
88673423ec6197a4dd908f2eeea08fd18162b50c
SHA256:
6B2AD2D76A80070A5398E7FB3149F03E0D3DA7496A0CFD215119C0A8F8CE7E1C
File Size:
648.19 KB, 648192 bytes
|
|
MD5:
8aae0c875702b49c1f00cadfeeb3a013
SHA1:
8d95d9048dbd67454775621f6e9c075fd9018534
SHA256:
AA4599BA65ECA0D7AF69455F16B7E343E8F60EA76D2CA75C90B5BF965C4A1E56
File Size:
971.78 KB, 971776 bytes
|
Show More
|
MD5:
603c27f4aa6142aa5e55bba91bd20a79
SHA1:
3b64b3d339c3787259a0b21861b3da75ff32ce95
SHA256:
BDB5EF300F28A0CEAFBF74D215C79CEDDE15D90E1ADC36F198DD49F7227ECB19
File Size:
645.12 KB, 645120 bytes
|
|
MD5:
4cbf553f39b5776dbffd2e5b4eed6775
SHA1:
c1d752f3b136f8cca5eab9415315f60cb48fe8ff
SHA256:
7C4C5ABFD7F2C8227EB4BC2B945765EE03B9AB372D2E05AD20BAE7010630D74D
File Size:
642.05 KB, 642048 bytes
|
|
MD5:
16dc55ced2ca8781d835a8126cd66f4d
SHA1:
5e45ab460a2bfea8061e9b97d9ded9174ce1e14c
SHA256:
CD9B47C5A07E5A9AA78994CEBEE7ED6F2E631A4C482B6B2EE8481682C16DC667
File Size:
1.02 MB, 1015808 bytes
|
|
MD5:
f6a20608a943f771685c4aaf2988c0b3
SHA1:
ebba09c4136e1b6af7c41505afc94ac90d06214f
SHA256:
FCD87D1F18832F3F22583EF08F1145FB9C030764CD9CE5B74D7F1E2A21D0882F
File Size:
620.03 KB, 620032 bytes
|
|
MD5:
a415ae5b96e1b361430a97f0ea50a7ce
SHA1:
7b57a6999afc34ff5d15a217ffe0d8552cba9a7a
SHA256:
975807A4FC3F81E4385D210673306C61EC31BA89E9E2828EF7C36168F31651CD
File Size:
636.42 KB, 636416 bytes
|
|
MD5:
47f14821d9ae0e9ab9a6cc9322d19184
SHA1:
b3083f93cb871dc64f005f9dd11d83549a1f0045
SHA256:
52DCF74BC12A1D627847054F516C6689156401B8ADFF8BF386081D0CA9001A89
File Size:
793.09 KB, 793088 bytes
|
|
MD5:
714a3c9cb6022a3518c3e621384fb6e3
SHA1:
fca806ce2816fe3b1361b0708b33c0c5dd431ea4
SHA256:
DC1E8A2FCC34AACE7B525115E6CA8D697775643D866AAB5395FAB0C754F05927
File Size:
790.53 KB, 790528 bytes
|
|
MD5:
52bbb984cf2b39e1f30ebd78130e1aed
SHA1:
c63044660a12e51fc2fa4dda84b53ea7dfc57ea7
SHA256:
ABB7C0EF2C15DEC3B73834B1F07D2AA0D5C65246FC0F34A930796C3DD7876BC6
File Size:
681.47 KB, 681472 bytes
|
|
MD5:
24bc3e0679b2c6c14b72279210959059
SHA1:
3bfd72b9e03bf6a5be81b9d1cb772c9f224776bd
SHA256:
64D93CEB3286438B0B7339F5AD544C21591BBDD667FBD794C1CEA3F09AAB99F9
File Size:
523.26 KB, 523264 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| File Version | 1.0.0.0 |
| Internal Name |
Show More
|
| Original Filename |
Show More
|
| Product Version | 1.0.0.0 |
File Traits
- .NET
- GenKrypt
- HighEntropy
- Reactor
- RijndaelManaged
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 89 |
|---|---|
| Potentially Malicious Blocks: | 9 |
| Whitelisted Blocks: | 69 |
| Unknown Blocks: | 11 |
Visual Map
x
x
?
?
?
?
?
x
?
x
?
x
?
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Agent.ONR
- MSIL.Krypt.GJLD
- MSIL.Stealer.LKB
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\dav rpc service | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| \device\namedpipe\pshost.134184613086641008.7804.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134207209880921577.6700.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134210173871448413.2772.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134212658730818527.5728.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134213986267673891.7428.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\wkssvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\__psscriptpolicytest_03yrj4bo.5q1.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_0tkvf5fz.m1v.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_305mmnxl.ps3.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_4wlade1u.dts.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_a330xyqt.aed.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_fcv5j1ql.0cs.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_kt44qbhm.og4.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_suiwfsez.12m.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_urmhtweg.mkl.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_yrdrauut.bdn.ps1 | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 㣬핛렱ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 籬ཇ첿ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | Ｔ⫝̸콱ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 睪렆톳ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꈽ콧틨ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
32 additional items are not displayed above. |
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Other Suspicious |
|
| Network Info Queried |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Gfzzomzv\AppData\Roaming\WindowsServices\FLiNG-AutoUpdate.exe'
|
"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Kdhwwjgn\AppData\Roaming\msvcp110_win\msvcp110.exe'
|
"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Ejpjzmjm\AppData\Roaming\msvcp110_wins\msvcps10.exe'
|
