Threat Database Trojans Trojan.MSIL.Kryptik.KC

Trojan.MSIL.Kryptik.KC

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 5,886
Threat Level: 80 % (High)
Infected Computers: 144
First Seen: December 31, 2025
Last Seen: July 16, 2026
OS(es) Affected: Windows

The detection of Trojan.MSIL.Kryptik.KC on your system indicates a potential security threat. This type of malware is designed to infiltrate and compromise your computer, often without your knowledge or consent. It's essential to understand the nature of this threat and take immediate action to remove it and protect your system from further damage.

What Is Trojan.MSIL.Kryptik.KC?

Trojan.MSIL.Kryptik.KC is a type of Trojan horse malware, which is a broad category of malicious software that disguises itself as legitimate or harmless. The name "Trojan" refers to the mythological Trojan Horse, where enemies were hidden inside a gift. Similarly, Trojan malware hides within seemingly innocuous programs or files, waiting to unleash its malicious payload once inside your system. The specifics of Trojan.MSIL.Kryptik.KC's behavior and impact can vary, but its primary goal is to compromise your system's security and potentially steal sensitive information, disrupt operations, or provide unauthorized access to your computer.

How Trojan.MSIL.Kryptik.KC Operates

Trojan.MSIL.Kryptik.KC, like other Trojans, operates by exploiting vulnerabilities in your system's defenses. It may arrive via email attachments, infected software downloads, or through exploits in web browsers or other applications. Once installed, it can execute a range of malicious activities, from data theft and espionage to using your computer as a botnet node for distributing spam or launching denial-of-service attacks. The exact mechanisms and goals of Trojan.MSIL.Kryptik.KC can depend on its specific programming and the intentions of its creators.

Symptoms of Infection

Identifying a Trojan infection can be challenging due to its stealthy nature. However, several symptoms may indicate that your system is compromised. These include unexpected changes to your computer's settings, unusual network activity, slow system performance, frequent crashes, or the appearance of unwanted programs or toolbars. If you suspect that your system has been infected with Trojan.MSIL.Kryptik.KC, it's crucial to act quickly to mitigate any potential damage.

How to Remove Trojan.MSIL.Kryptik.KC

  1. Boot your computer in Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
  2. Conduct a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of the malware.
  3. Uninstall any suspicious programs that you do not recognize or that were installed around the time of the suspected infection.
  4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the Trojan.
  5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all remnants of the malware have been removed.

Conclusion

Removing Trojan.MSIL.Kryptik.KC from your system requires careful and immediate action. By following the steps outlined above and maintaining vigilance in your online activities, you can help protect your computer from future infections. Regularly updating your operating system, applications, and security software, as well as being cautious with emails and downloads, are key practices in preventing malware infections. If you're unsure about any aspect of the removal process or feel that your system remains compromised after attempting removal, consider seeking assistance from a professional cybersecurity expert.

Analysis Report

General information

Family Name: Trojan.MSIL.Kryptik.KC
Signature status: No Signature

Known Samples

MD5: 3fc8f7890e9b49b80f634c4b1bb3bc51
SHA1: f59fcffb4fffc3998741dc0a7fbb059cc9621cf8
SHA256: C5E4E62CDB2A54A97D46808E32AB66F889634339B72DE7B874A1487F9E421EB4
File Size: 367.10 KB, 367104 bytes
MD5: 99a168afd3503d4844764711052928a8
SHA1: 905ce4111dfbcc916997bb6bf00f5715eea51f5f
SHA256: CEB5BE2B0FC3E3CCFBAAB8EF90FB02D3EFD17DDA1BCF349810CC9195EBD7B74F
File Size: 378.88 KB, 378880 bytes
MD5: 3af27e41d59e0dbe93614db0d898c8dd
SHA1: 9cccc991dab31329a60ac60803e8f2da4ac3caa1
SHA256: 9E6BE5D1E3558F62300B8FF8C7BC71D82F0DCFE33ED1BB57F52585426B61BEA7
File Size: 289.79 KB, 289792 bytes
MD5: 16c9d374af6f98a2b4bb09b6cdd5a403
SHA1: 61a6c2f708ea47c0ea6e228f4c0fc7e577e9f0ef
SHA256: 2BB042E30AA39B73A2A6E7DE5EDC4F6E4F83D2FB370E418FC96F663F7862E17B
File Size: 377.86 KB, 377856 bytes
MD5: 2235e2586b8a6fa31609cf6d783c0d1d
SHA1: 8c8e98ee6c203a400f7f06b213f298470f905ace
SHA256: 4442BA4C60A6FC24A2B2DFD041A86F601E03B38DEAB0300A6116FEA68042003F
File Size: 678.91 KB, 678912 bytes
Show More
MD5: 14894f093fb6d1a9dbf68df69506a665
SHA1: 17229f46a96639920b8e8ee311b7cb138ff86080
SHA256: C11282743C579DFDC692AEE2D928CB6E349B39A3E0B3E80A2846667014613825
File Size: 377.34 KB, 377344 bytes
MD5: 372aa0df84cd96fa51ba593ffd19d0f6
SHA1: 6ccc77c83b3ddec386f1c39ff962425b4ee45082
SHA256: 2FBBCE8D7EA938FCB654018A9ED26A03527ACBDEDC76936D55FA7493C0BBD02C
File Size: 377.34 KB, 377344 bytes
MD5: a544d9f927d52f5c8d825c3eb43c3431
SHA1: 051eec90d0d522a3b9f66db61960697c925c16a3
SHA256: C1054DACFA5844DE7A43A8D9DDB723DE3316902C9FD890FD3DEFF38AE072AA0E
File Size: 377.86 KB, 377856 bytes
MD5: 3992d836d353d7676c93a57f4f23630e
SHA1: df8a2239379df68f4a1fecdb49a59a68eea2e75b
SHA256: 8EA05E7E867EA91CE4D117020EAF7CA59CE06C76BE03F052EE8E8BA37CE09A8A
File Size: 288.26 KB, 288256 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version 1.0.0.0
File Version 1.0.0.0
Internal Name
  • Cazqs.exe
  • Gkzxz.exe
  • Jejpcbyv.exe
  • Mlcqimjw.exe
  • Nnlvo.exe
  • Uunaezehgcn.exe
  • Vdzagbo.exe
  • Xzzblqtmmzi.exe
  • Yuvwcaaxa.exe
Original Filename
  • Cazqs.exe
  • Gkzxz.exe
  • Jejpcbyv.exe
  • Mlcqimjw.exe
  • Nnlvo.exe
  • Uunaezehgcn.exe
  • Vdzagbo.exe
  • Xzzblqtmmzi.exe
  • Yuvwcaaxa.exe
Product Version 1.0.0.0

File Traits

  • .NET
  • GenKrypt
  • HighEntropy
  • x64
  • x86

Block Information

Total Blocks: 10
Potentially Malicious Blocks: 3
Whitelisted Blocks: 1
Unknown Blocks: 6

Visual Map

x x ? ? x ? ? ? 0 ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
\device\namedpipe\dav rpc service Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe\pshost.134124444053903184.4636.defaultappdomain.powershell Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\pshost.134134090979908270.2420.defaultappdomain.powershell Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\pshost.134141372082452370.6840.defaultappdomain.powershell Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\pshost.134167399834636809.5012.defaultappdomain.powershell Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\pshost.134203464612692611.4740.defaultappdomain.powershell Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288
\device\namedpipe\wkssvc Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\__psscriptpolicytest_1d0hs2ii.0qx.psm1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_1yvpl23k.141.psm1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_3b0xfjsf.kuk.ps1 Generic Write,Read Attributes
Show More
c:\users\user\appdata\local\temp\__psscriptpolicytest_4wmhvnq1.s04.ps1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_g3ho2cng.4hb.ps1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_kvkyutxz.5fp.ps1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_lbwpcnol.sxz.ps1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_nhe2vwfh.oql.psm1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_nrpjwrhm.br0.psm1 Generic Write,Read Attributes
c:\users\user\appdata\local\temp\__psscriptpolicytest_sp5c33pe.pnk.psm1 Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe �ۏ�x�� RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 蒅봨訾ǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 㛹±郞ǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 榮ྞꢊǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe ♊௦쥗ǜ RegNtPreCreateKey

Windows API Usage

Category API
User Data Access
  • GetUserDefaultLocaleName
  • GetUserName
  • GetUserNameEx
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
Other Suspicious
  • AdjustTokenPrivileges
Process Manipulation Evasion
  • NtUnmapViewOfSection
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelTimer2
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
Show More
  • ntdll.dll!NtClose
  • ntdll.dll!NtCompareSigningLevels
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushProcessWriteBuffers
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCachedSigningLevel
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtUnsubscribeWnfStateChange
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtYieldExecution
  • UNKNOWN
Network Winsock2
  • WSAConnect
  • WSASocket
  • WSAStartup
Network Winsock
  • closesocket
  • setsockopt

Related Posts

Trending

Most Viewed

Loading...