Trojan:MSIL/Krypt.IKom is a malicious program written in .NET (MSIL, or Microsoft Intermediate Language) that belongs to the Krypt family of information-stealing trojans. This threat is designed to establish unauthorized access to infected Windows machines, often serving as a conduit for additional malware payloads or harvesting sensitive data including login credentials, cryptocurrency wallet files, and browser-stored passwords. It typically arrives disguised as legitimate software or bundled with pirated applications, making it particularly dangerous for users who download programs from untrusted sources.
Once established on a system, Krypt.IKom employs multiple persistence mechanisms to survive reboots and evade basic detection attempts. The trojan operates quietly in the background, making outbound connections to command-and-control servers while simultaneously monitoring user activity and filesystem locations where valuable data is commonly stored. Like other members of the Krypt family, this variant is distributed through exploit kits, malicious email attachments, and compromised download sites.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Information-stealing Trojan, Credential Harvester |
| Family | Krypt (MSIL-based trojan family) |
| Common Aliases | MSIL/Krypt.IKom, Trojan.MSIL.Krypt, Agent.IKom, Generic.Krypt |
| Platform | Windows (all versions with .NET Framework 4.0+) |
| First Observed | 2018–2019 (this variant) |
| Distribution Methods | Malicious email attachments, software cracks, exploit kits, bundled installers |
| Persistence Mechanisms | Registry Run keys, Scheduled Tasks, startup folder entries |
| Primary Capabilities | Credential theft, keylogging, browser data exfiltration, cryptocurrency wallet harvesting, remote command execution |
| Typical File Locations | %LOCALAPPDATA%\[random], %APPDATA%\[GUID folders], %TEMP% |
| Network Behavior | Outbound HTTPS connections to C2 servers, often using compromised legitimate sites as relays |
| Data Exfiltration | ZIP archives uploaded to remote servers, encrypted data streams |
| Removal Difficulty | Moderate to High (employs obfuscation, multiple persistence points) |
How It Spreads
Trojan:MSIL/Krypt.IKom reaches victim computers through various social engineering and exploitation tactics, with the most common being software piracy sites and malicious email campaigns. Attackers frequently bundle this trojan with cracked versions of popular commercial software, video games, or productivity tools. Users searching for "free" versions of expensive programs become the primary targets, downloading what appears to be a working crack or keygen that actually contains the trojan payload. These infected installers often include legitimate software alongside the malware, making the infection less immediately obvious.
Email-based distribution campaigns represent another significant infection vector. Threat actors send messages impersonating shipping companies, financial institutions, or government agencies, with attachments presented as invoices, receipts, or urgent notices. These attachments are typically ZIP archives or Office documents with malicious macros that, when enabled, download and execute the Krypt.IKom payload. The emails employ urgency tactics—"Your package requires immediate confirmation" or "Account suspension notice"—to pressure recipients into opening attachments without careful scrutiny.
Additional distribution methods include:
- Exploit kits on compromised websites: Legitimate sites infected with malicious scripts that probe visitors' browsers for vulnerabilities and silently install the trojan
- Malvertising campaigns: Poisoned advertisements on otherwise legitimate sites that redirect to download pages hosting the malware
- Trojanized software updates: Fake update notifications for Adobe Flash, Java, or media codecs that deliver malware instead
- Peer-to-peer networks: Infected files shared on torrent sites, often disguised as popular movies, TV shows, or software
- USB drives and removable media: Less common but still viable, particularly in targeted attacks where infected drives are left in parking lots or public spaces
- Remote Desktop Protocol (RDP) exploitation: Brute-force attacks against poorly secured RDP connections, followed by manual trojan installation
What It Does On Your Machine
Upon execution, Trojan:MSIL/Krypt.IKom immediately begins establishing itself on the infected system. The malware typically extracts itself from a dropper executable into a randomly named folder within the user's AppData directory structure. Being written in MSIL, it requires the .NET Framework to run—fortunately for the attacker, this framework is installed by default on most modern Windows systems. The trojan often arrives obfuscated using commercial .NET protectors or custom packers to evade signature-based antivirus detection during initial installation.
Once unpacked, Krypt.IKom creates multiple persistence mechanisms to ensure it survives system reboots. The trojan adds registry entries to the current user's Run key, pointing to its executable in the hidden AppData folder. It may also create scheduled tasks configured to launch at user logon or at regular intervals throughout the day. Some variants of this family copy themselves to the Windows startup folder or modify existing scheduled tasks to inject their payload. This redundancy makes manual removal challenging, as eliminating only one persistence point leaves the others intact, allowing the malware to re-establish itself.
The trojan's primary function is information theft. It systematically scans the infected machine for valuable data, targeting browser credential stores (Chrome, Firefox, Edge, Opera), saved passwords in applications like FileZilla or email clients, cryptocurrency wallet files (Bitcoin, Ethereum, Monero wallet.dat files), and desktop files with names suggesting financial or authentication content. The malware employs keylogging capabilities to capture credentials entered after infection, recording keystrokes and periodically transmitting logs to the command-and-control infrastructure. Screenshots may be captured at intervals or when specific applications are detected running, such as banking sites or cryptocurrency exchanges.
Krypt.IKom maintains persistent communication with remote servers controlled by the attackers. These connections use HTTPS to blend with normal web traffic and evade network monitoring. The trojan reports back information about the infected system—OS version, installed antivirus software, running processes, and user account details—allowing operators to classify victims by value. High-value targets (those with cryptocurrency wallets, corporate email accounts, or evidence of financial activity) may receive additional payloads, including more sophisticated spyware, ransomware, or banking trojans. The malware also receives commands from the C2 server, enabling operators to update the malware, download additional tools, or exfiltrate specific files on demand.
Manual Removal — Step by Step
Disconnect From the Internet Immediately
Before attempting removal, physically disconnect your computer from the network by unplugging the ethernet cable or disabling your Wi-Fi adapter. This prevents the trojan from receiving new commands, exfiltrating additional data, or downloading supplementary payloads during the removal process. For laptops, also consider removing the battery if easily accessible to prevent any potential firmware-level persistence from activating.
Boot Into Safe Mode With Networking
Restart your computer and enter Safe Mode with Networking. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select option 5 (Enable Safe Mode with Networking). Safe Mode loads only essential system processes, preventing most malware from launching automatically and making it easier to identify and remove malicious processes without interference.
Identify and Terminate Malicious Processes
Open Task Manager (Ctrl+Shift+Esc) and carefully examine running processes. Look for suspicious entries with random names, processes running from AppData folders, or anything masquerading as legitimate Windows services (like "svchost.exe" running from non-system locations). Right-click suspicious processes, select "Open file location" to verify the path, then end the process. Note the full path and filename for later deletion. Krypt.IKom often uses names similar to legitimate Windows components to avoid detection.
Remove Persistence Mechanisms From the Registry
Open Registry Editor (type "regedit" in the Start menu) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the corresponding HKEY_LOCAL_MACHINE location. Look for entries with suspicious paths pointing to AppData folders or random GUID directories. Delete any entries that reference the malicious executable you identified. Also check RunOnce keys in both hives. Exercise caution—deleting legitimate Windows entries can cause system instability, so only remove items you're certain are malicious.
Eliminate Scheduled Tasks
Open Task Scheduler (search for it in the Start menu) and examine the Task Scheduler Library. Sort by "Author" or "Triggers" and look for tasks created by unknown authors or triggered at user logon. Examine each suspicious task's "Actions" tab to see what executable it runs. Delete tasks pointing to AppData folders or the paths you identified earlier. Krypt.IKom commonly creates tasks with names mimicking legitimate Microsoft services like "MicrosoftEdgeUpdateCore" or "WindowsDefenderScheduledScan" to blend in.
Delete Malware Files and Folders
Navigate to the file locations you identified in earlier steps—typically folders within %LOCALAPPDATA% or %APPDATA%. Delete the entire containing folder, not just the executable, as supporting files and configuration data may be present. You may need to enable "Show hidden files and folders" in File Explorer options. Also clear the Temp folder at C:\Users\[YourName]\AppData\Local\Temp completely, as droppers often leave remnants there. If Windows reports the file is in use, the process wasn't fully terminated—return to Task Manager.
Scan With Reputable Anti-Malware Software
Reconnect to the internet and download Malwarebytes (free version is sufficient) or use Windows Defender with updated definitions. Run a complete system scan—not a quick scan—which typically takes 30-90 minutes depending on drive size. These tools often detect persistence mechanisms or associated files that manual removal might miss. Quarantine or delete all detected threats. Consider running a second scan with a different tool (such as HitmanPro or ESET Online Scanner) to catch anything the first missed, as no single scanner detects everything.
Reset Web Browsers to Default Settings
Since Krypt.IKom harvests browser data, reset all installed browsers to eliminate any malicious extensions or modified settings. In Chrome, go to Settings > Reset and clean up > Restore settings to their original defaults. In Firefox, type "about:support" in the address bar and click "Refresh Firefox." In Edge, navigate to Settings > Reset settings > Restore settings to their default values. This removes saved passwords (which are already compromised), so you'll need to re-enter credentials after changing them.
Change All Passwords From a Clean Device
Assume that every password entered on the infected machine has been compromised. Using a different, known-clean computer or smartphone, change passwords for critical accounts: email, banking, social media, cryptocurrency exchanges, and any work-related services. Enable two-factor authentication wherever possible. If you stored cryptocurrency on the infected machine, immediately transfer funds to new wallets with new seed phrases generated on a clean device. Check bank and credit card statements for unauthorized transactions.
Reboot and Verify Clean System
Restart your computer normally (not in Safe Mode) and monitor for any signs of remaining infection: unexpected network activity, unknown processes in Task Manager, new scheduled tasks appearing, or degraded performance. Run another quick scan with your anti-malware tool. Check the registry Run keys again to ensure nothing has reappeared. Monitor your computer for the next few days—if persistence mechanisms were missed, the malware may attempt to re-establish itself. If suspicious activity continues, professional removal may be necessary to address rootkit-level persistence.
Prevention
- Never download software from unofficial sources. Pirated software, cracks, and keygens are the most common delivery method for trojans like Krypt.IKom. The money saved on a $50 program isn't worth the risk of identity theft, ransomware, or banking fraud. Stick to official websites, verified app stores, or authorized resellers.
- Scrutinize email attachments with extreme skepticism. Legitimate companies rarely send unexpected attachments. Before opening any attachment, verify the sender's email address carefully (not just the display name), hover over links to check actual URLs, and call the company using a number you look up independently—never one provided in a suspicious email. When in doubt, don't click.
- Keep Windows and all software updated. Enable automatic updates for Windows, your browsers, Adobe products, Java, and all other installed software. Exploit kits depend on outdated software with known vulnerabilities. Most modern malware infections succeed because systems are running years-old software versions with publicly documented security holes.
- Use reputable antivirus software and keep it updated. While no antivirus catches everything, quality security software (Windows Defender is adequate if kept updated; Malwarebytes Premium is better) provides essential protection against known threats. Configure it to update definitions automatically and run scheduled scans weekly. Don't disable your antivirus just because a program "won't install with it running"—that's a massive red flag.
- Implement proper backup procedures. Maintain regular backups of important data on external drives or cloud storage, stored disconnected from your computer when not actively backing up. This won't prevent trojan infections, but it eliminates the catastrophic data loss that often follows ransomware deployment after initial compromise by a trojan like Krypt.IKom.
- Use unique, strong passwords with two-factor authentication. Password reuse means a breach on one site compromises all sites using that password. Use a reputable password manager to generate and store unique passwords for every account. Enable two-factor authentication (preferably app-based like Authy or hardware keys, not SMS) on every service that offers it, especially email and financial accounts.
- Restrict user account privileges. Don't use an administrator account for daily activities. Create a standard user account for routine computing and only elevate to administrator when installing verified software. This limits malware's ability to make system-wide changes or install persistence mechanisms that affect all users.
- Educate everyone who uses your computers. If family members or employees use your devices, ensure they understand basic security practices: not clicking suspicious links, not downloading from untrusted sources, and reporting anything unusual immediately. The most sophisticated security measures fail when users are tricked into voluntarily installing malware.
Bring It In
Manual removal of Trojan:MSIL/Krypt.IKom is possible for technically inclined users, but it's time-consuming, carries risks of incomplete removal or system damage, and requires absolute certainty that you've eliminated every component. This trojan family is sophisticated, employing multiple persistence mechanisms and often downloading additional malware that complicates the infection. If you're not completely confident in your ability to clean the infection thoroughly, or if you've attempted removal and suspect remnants remain, professional service is the safer choice.
Computer Repair Roswell specializes in complete malware eradication for customers throughout the North Atlanta area. We use enterprise-grade tools not available to consumers, combined with manual forensic analysis to identify everything the infection modified. We'll secure your data, eliminate the malware and any associated infections, verify system integrity, update your security software, and explain what happened and how to prevent it. Most malware removals are completed same-day. Call us at (770) 569-2001 or stop by our Roswell location at 1255 Canton Street. Don't let a trojan infection put your personal information, financial accounts, or business data at risk—let's get your computer clean and secure today.