Trojan.Win64.CRYPTINJECT.AH

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "{malware filepath}\{malware filename" → deletes malware after connection timeout
• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%Program Data%\pentera_temp" → deletes created folder after connection timeout

Erstellt die folgenden Ordner:

• %Program Data%\pentera_temp → stores downloaded shell code

Datendiebstahl

Folgende Daten werden gesammelt:

• Username
• Hostname

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• {IP address}

Es macht Folgendes:

• It looks for the file \?\C:\Users\All Users\pentera_temp\data.bin(encrypted shellcode) through the provided IP address in the parameter.
• It receives an encrypted shell code from a remote server through the provided IP address in the parameter.
• It injects a shell code to a specified process ID.
• It logs all of its activity through a console.