Trojan.Win32.CRYPTINJECT.EN

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %Program Data%\pentera_temp → stores downloaded shell code

Backdoor Routine

This Trojan connects to the following websites to send and receive information:

• {IP address} → parameter used

Information Theft

This Trojan gathers the following data:

• Username
• Hostname

Other Details

This Trojan does the following:

• It looks for the file \?\C:\Users\All Users\pentera_temp\data.bin through the provided IP address in the parameter.
• It receives an encrypted shell code from a remote server through the provided IP address used as a parameter.
• It then injects the shell code it gets to a specified process ID.

It accepts the following parameters:

• {IP address}