File scan report
Verdict Malicious
Is Mystic.
44 of the 71 antivirus engines that checked it, including 11 major ones, flag this unsigned 64-bit Windows executable as a crypted trojan, though sandbox runs stayed quiet.
Strong evidence · Two or more major antivirus engines agree.
Do not run this executable and remove it if you have already downloaded it. If it was executed, run a full scan with your security software, review startup entries and scheduled tasks, and keep your protection enabled.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
44 of 71 flagged
- Flagged 44
- No detection 27
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
7 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
44 of the 71 antivirus engines that checked it flag this unsigned executable, with 11 major antivirus engines naming a crypted or generic trojan, and a large data section that looks encrypted rather than packed by a known tool. Sandbox runs stayed quiet with no dropped files or callbacks, but families like this typically only unpack in the right context.
The detection picture is unusually broad for a false positive: 44 of the 71 antivirus engines that checked it flagged this 64-bit Windows executable, and after collapsing vendors that share one scan engine, 32 remained — 11 of them from major antivirus engines including Microsoft, ESET-NOD32, BitDefender, Sophos, Symantec and Fortinet. The labels cluster around crypted-trojan naming (GenKryptik, Trojan.Generic, Wacatac, Artemis), and the file also carries the tag "spreader" alongside a popular threat label naming a trojan. No single family could be confirmed, since the names are generic buckets rather than a specific malware lineage. The file is unsigned with no publisher history, so nothing balances those detections. Our own inspection of the bytes was not performed for this hash, so the structural read comes from the antivirus analysis: high overall entropy with a near-maximum .data section and no recognised packer, which fits an encrypted payload that decrypts itself at run time rather than a packed off-the-shelf binary.
What We Detected
This is a 3.9 MB unsigned 64-bit Windows executable, first seen on Oct 8, 2026 and submitted by 17 distinct sources since. The antivirus network is close to unanimous: 44 of the 71 antivirus engines that checked it flagged it, and even after accounting for vendors that license the same scan engine, 32 independent detections remain. Eleven of the flagging products are major antivirus engines, including Microsoft, ESET-NOD32, BitDefender, Sophos, Symantec, Fortinet, Ikarus and Trellix, with labels such as crypted-trojan, generic trojan and a machine-learning high-confidence verdict.
The file is unsigned. There is no publisher identity, no publisher history in our records, no reference-database entry and no community rule match against this exact hash, so nothing in the evidence offsets those detections.
Threat Behavior
The sample was executed four times in automated sandboxes and the combined result was quiet: no files were dropped, no persistence was set, no remote control addresses were contacted, and the only remote address recorded belongs to the analysis environment's own background traffic rather than to the file. That is not unusual for a crypted loader — the first stage can run, resolve its arguments and exit without unpacking when it does not find the conditions it wants.
What the antivirus analysis shows structurally is a large data section with near-maximum entropy against an otherwise ordinary PE layout, and no recognised packer. Encrypted payload data of that kind is what a loader looks like before it decrypts itself. The file also accepts installer-style switches, and it carries the tag "spreader" together with a popular threat label naming a trojan family, which matches several engine labels on this hash.
We could not confirm a specific malware family: the labels point at generic crypted-trojan buckets rather than one named lineage. No host-reputation result was completed for the network identifiers observed in the sandbox, so the absence of known-bad destinations is missing coverage rather than a clean finding.
What To Do Now
Do not run this file. Delete it from your downloads and empty the recycle bin, and if it has already been executed, run a full scan with your security software and check for new startup entries and scheduled tasks. If it arrived as a link, attachment or bundled installer from an untrusted source, treat the sender and the download page as compromised, and keep your antivirus and security software enabled throughout.
Where this verdict could be wrong3 caveats
- The combined sandbox result was clean across the runs performed: no dropped files, no persistence entries and no outbound remote control addresses were recorded, so the payload's hostile stage may not activate outside its intended install context.
- No established malware family could be confirmed — the antivirus labels are generic or cryptor-style buckets, and no public sample database or community rule set carries this exact hash.
- The contacted-host reputation cross-check was not completed, so the absence of known-bad destinations is missing coverage rather than a clean network finding.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The combined sandbox result across the runs performed was clean, with no dropped files, no persistence entries and no remote control traffic attributed to the sample
- No packer or known wrapper was identified in the executable's structure
- No public sample database or community rule set carries this exact hash, so the family attribution stays generic
- 44 of the 71 antivirus engines that checked it flagged the file, 32 of them independent after accounting for shared scan engines
- 11 major antivirus engines flagged it, including Microsoft, ESET-NOD32, BitDefender, Sophos, Symantec and Fortinet
- The executable is unsigned and has no publisher history in our records
- Engine labels cluster around crypted and generic trojan naming, which fits an encrypted loader
- The file carries a 'spreader' tag and a popular threat label naming a trojan
- A large data section shows near-maximum entropy with no recognised packer, consistent with an encrypted payload
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 13sandbox rule tags
- 3spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Hid files or windows on the test computer.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 3: FileSeen in the test run
Mystic.exe
b6eb985a02de12dc86b77084244cb92c87eeec031fb6aa08fb39fe2bd88bba20
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 3: ProcessSeen in the test run
Mystic.exe
"C:\Users\user\Desktop\Mystic.exe" -install
Test run - Evidence 3 of 3: ProcessSeen in the test run
Mystic.exe
"C:\Users\user\Desktop\Mystic.exe" /install
Test run - +1 more recorded observation
3 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1056.001· Keylogging
- T1071· Application protocol
- T1083· Scans your files
- T1115
- T1129· Loads modules
- T1553
- T1553.002
- T1564.003· Hides artifacts
- T1614
Observed activity
Processes started
3Programs the file ran, with their command lines.
Mystic.exe"C:\Users\user\Desktop\Mystic.exe" -installMystic.exe"C:\Users\user\Desktop\Mystic.exe" /installMystic.exe"C:\Users\user\Desktop\Mystic.exe" /load
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Chapter 04
Technical details
44 of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 44
- Avast (major engine)Win64:Evo-gen [Trj]
- AVG (major engine)Win64:Evo-gen [Trj]
- Avira (major engine)TR/W64.Evo
- BitDefender (major engine)Trojan.Generic.40646281
- Emsisoft (major engine)Trojan.Generic.40646281 (B)
- ESET-NOD32 (major engine)Win64/GenKryptik_AGen.EVL trojan
- F-Secure (major engine)Trojan.TR/W64.Evo
- Fortinet (major engine)W64/GenKryptik_AGen.EVL!tr
File fingerprint
- Last analyzed
- Nov 9, 2026, 7:45 PM UTC
- SHA-256
b6eb985a02de12dc86b77084244cb92c87eeec031fb6aa08fb39fe2bd88bba20- SHA-1
c52304c7e422ccaa58afc6fdfc72829db3089fb7- MD5
bbdce187b5eb63a3fde94d43e3b0ce36
About this file
Mystic.exe is a Win32 EXE file of 4.0 MB.
- Type and size
- Win32 EXE · 4.0 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 8, 2026On VirusTotal.
- Submitted by
- 17 distinct sources
- Packer
- None detected
- Entropy
- 7.29 of 8
First scanned
Antivirus consensus
44 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 44 detections come from 32 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines11flagged16 vendors sharing 11 engines
- Tier-236 engines13flagged17 vendors sharing 13 engines
- Low-trust17 engines11flagged
View all 75 engine results
- AlibabaMalicious: Trojan:Win64/GenKryptik.b5d1bbfd
- alibabacloudMalicious: Trojan:Win/GenKryptik_AGen.EYA
- ALYacMalicious: Trojan.Generic.40646281
- Antiy-AVLMalicious: Trojan/Win64.GenKryptik
- APEXMalicious: Malicious
- ArcabitMalicious: Trojan.Generic.D26C3689
- AvastMalicious: Win64:Evo-gen [Trj]
- AVGMalicious: Win64:Evo-gen [Trj]
- AviraMalicious: TR/W64.Evo
- BitDefenderMalicious: Trojan.Generic.40646281
- BkavMalicious: W32.Malware.3B31BB02
- CrowdStrikeMalicious: win/malicious_confidence_70% (W)
- CTXMalicious: exe.trojan.genkryptik
- CylanceMalicious: Unsafe
- CynetMalicious: Malicious (score: 100)
- ElasticMalicious: malicious (high confidence)
- EmsisoftMalicious: Trojan.Generic.40646281 (B)
- ESET-NOD32Malicious: Win64/GenKryptik_AGen.EVL trojan
- F-SecureMalicious: Trojan.TR/W64.Evo
- FortinetMalicious: W64/GenKryptik_AGen.EVL!tr
- GDataMalicious: Trojan.Generic.40646281
- GoogleMalicious: Detected
- IkarusMalicious: Trojan.Win64.Krypt
- K7AntiVirusMalicious: Trojan ( 006e8b8f1 )
- K7GWMalicious: Trojan ( 006e8b8f1 )
- LionicMalicious: Trojan.Win32.Generic.4!c
- MaxSecureMalicious: Trojan.Malware.328790041.susgen
- McAfeeDMalicious: ti!B6EB985A02DE
- MicrosoftMalicious: Trojan:Win32/Wacatac.B!ml
- MicroWorld-eScanMalicious: Trojan.Generic.40646281
- PaloaltoMalicious: generic.ml
- PandaMalicious: Trj/PhxGD.A
- RisingMalicious: Trojan.Kryptik!8.8 (CLOUD)
- SangforMalicious: Trojan.Win64.Kryptik.V061
- SentinelOneMalicious: Static AI - Suspicious PE
- SkyhighMalicious: BehavesLike.Win64.Ransomware.wc
- SophosMalicious: Mal/Generic-S
- SymantecMalicious: ML.Attribute.HighConfidence
- TencentMalicious: Win32.Trojan.W64.Eplw
- TrellixENSMalicious: Artemis!BBDCE187B5EB
- TrendMicroMalicious: Trojan.Win32.WACATAC.USBLJ926
- TrendMicro-HouseCallMalicious: Trojan.Win32.WACATAC.USBLJ926
- VaristMalicious: W64/ABTrojan.FXUS-5633
- VIPREMalicious: Trojan.Generic.40646281
- AcronisClean
- AhnLab-V3Clean
- Avast-MobileNo result
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- DeepInstinctClean
- DrWebClean
- GridinsoftClean
- huorongClean
- JiangminClean
- KasperskyClean
- KingsoftClean
- MalwarebytesClean
- NANO-AntivirusClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TrapmineClean
- TrustlookNo result
- VBA32Clean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is Mystic.exe malware?
What is Mystic.exe?
How many antivirus engines detected Mystic.exe?
I already downloaded and ran Mystic.exe — what should I do?
How do I remove Mystic.exe?
What kind of malware is Mystic.exe?
What is the SHA-256 hash of Mystic.exe?
How up to date is this analysis of Mystic.exe?
Community
Member reviews and reports for this exact file hash.