Trojan.Win64.CRYPTINJECT.AH

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "{malware filepath}\{malware filename" → deletes malware after connection timeout
• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%Program Data%\pentera_temp" → deletes created folder after connection timeout

Crea las carpetas siguientes:

• %Program Data%\pentera_temp → stores downloaded shell code

Robo de información

Recopila los siguientes datos:

• Username
• Hostname

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• {IP address}

Hace lo siguiente:

• It looks for the file \?\C:\Users\All Users\pentera_temp\data.bin(encrypted shellcode) through the provided IP address in the parameter.
• It receives an encrypted shell code from a remote server through the provided IP address in the parameter.
• It injects a shell code to a specified process ID.
• It logs all of its activity through a console.