Home / malware

PDF

Trojan:Win32/Cryect.A

First posted on 10 November 2010.
Source: SecurityHome

Aliases :

Trojan:Win32/Cryect.A is also known as Trojan.Inject.RA (BitDefender).

Explanation :

Trojan:Win32/Cryect.A is a trojan that executes other malware and modifies system properties to elevate installed malware privileges that could allow further execution.
Top

Trojan:Win32/Cryect.A is a trojan that executes other malware and modifies system properties to elevate installed malware privileges that could allow further execution. Depending on the configuration data embedded in the malware, Trojan:Win32/Cryect.A may do the following:

Modify the Access Control List (ACLs) to elevate malware privilege

Execute the malware component:

"C:\winnt\srchasst\srchcsetls.dll" - detected as TrojanDownloader:Win32/Taleret.C

Attempt to overwrite "<system folder> \SERVICES.EXE" with a malicious copy embedded in the malware.

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Analysis by Rodel Finones

Last update 10 November 2010

 

TOP