{
  "family": "msilkrypt",
  "sample_count": 28,
  "category": "crypter",
  "description": "MsilKrypt (cataloged across security intelligence feeds under signatures including VirTool:MSIL/MsilKrypt, Trojan:MSIL/Krypt, and VirTool:MSIL/Kryptik) is an obfuscated .NET crypter, runtime unpacker, and binary protector framework active since 2014. Widely traded on underground cybercrime forums, MsilKrypt is engineered to wrap raw binary payloads—including commodity infostealers (Agent Tesla, Formbook), remote access trojans (AsyncRAT), and ransomware stagers—inside legitimate-looking .NET assemblies. Upon execution, MsilKrypt resolves AES or XOR decryption keys dynamically from embedded managed resources, bypasses the Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) via memory patching, and injects the decrypted payload directly into memory using reflective Assembly.Load or process hollowing into trusted Windows binaries such as RegAsm.exe or AppLaunch.exe.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:MSIL/MsilKrypt",
    "Trojan:MSIL/Krypt",
    "VirTool:MSIL/Kryptik",
    "MSIL/MsilKrypt",
    "Trojan:MSIL/MsilKrypt.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:MSIL/MsilKrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MsilKrypt is an obfuscated .NET crypter and loader used by cybercriminals to package and hide commodity trojans from antivirus scanners."
      }
    },
    {
      "@type": "Question",
      "name": "How does MsilKrypt bypass antivirus detections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It bypasses AMSI and ETW via in-memory byte patching and decrypts nested payloads dynamically inside memory without touching disk."
      }
    },
    {
      "@type": "Question",
      "name": "What payloads are commonly protected with MsilKrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use MsilKrypt to protect infostealers (Agent Tesla, Formbook), RATs (AsyncRAT, Remcos), and ransomware loaders."
      }
    },
    {
      "@type": "Question",
      "name": "How does MsilKrypt execute the decrypted payload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses reflective assembly loading or process hollowing into trusted .NET executables like RegAsm.exe or AppLaunch.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect MsilKrypt crypter binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy AMSI memory monitoring, inspect high-entropy embedded resources in .NET binaries, and detect abnormal child process creation from RegAsm.exe."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1055.012",
    "T1562.001",
    "T1140",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Attachments",
    "Underground Malware-as-a-Service Loaders",
    "Cracked Software Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "In-Memory .NET Payload Decryption",
    "AMSI & ETW Memory Patching",
    "Process Hollowing into RegAsm / AppLaunch",
    "Anti-Analysis & Sandbox Evasion",
    "High-Entropy Resource Extraction"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET Managed Executable (C# / VB.NET)",
      "Encrypted Resource Blob"
    ],
    "network_signatures": [
      "Network traffic originates from injected hollowed processes (such as RegAsm.exe or vbc.exe) rather than the parent binary",
      "Periodic DNS queries for secondary payload staging servers"
    ],
    "evasion_techniques": [
      "Patching AmsiScanBuffer in memory to prevent script and assembly scanning",
      "Checking for virtualization and analysis environments (VMware, VirtualBox, Sandboxie)"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2",
      "26b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MsilKryptStub"
    ],
    "file_paths": [
      "%Temp%\\msil_payload.exe",
      "%AppData%\\Krypt\\stub.bin"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint security that enforces AMSI integrity validation and flags in-memory memory patching of amsi.dll",
    "Monitor process creation events for unusual execution of RegAsm.exe, RegSvcs.exe, or AppLaunch.exe with network connections",
    "Inspect newly compiled .NET binaries for high resource entropy and absent metadata signatures"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:MSIL/MsilKrypt",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:MSIL/MsilKrypt"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - VirTool.MSIL.Kryptik",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:MSIL/MsilKrypt.A",
      "VirTool:MSIL/MsilKrypt.B"
    ]
  },
  "motivation": "Payload Protection, Defense Evasion & Antivirus Bypass",
  "sample_hashes": []
}