Trojan.Win64.CRYPTINJECT.AH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "{malware filepath}\{malware filename" → deletes malware after connection timeout
• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%Program Data%\pentera_temp" → deletes created folder after connection timeout

It creates the following folders:

• %Program Data%\pentera_temp → stores downloaded shell code

Information Theft

This Trojan gathers the following data:

• Username
• Hostname

Other Details

This Trojan connects to the following website to send and receive information:

• {IP address}

It does the following:

• It looks for the file \?\C:\Users\All Users\pentera_temp\data.bin(encrypted shellcode) through the provided IP address in the parameter.
• It receives an encrypted shell code from a remote server through the provided IP address in the parameter.
• It injects a shell code to a specified process ID.
• It logs all of its activity through a console.
  

It accepts the following parameters:

• {malware filepath}\{malware filename} {IP address}