Win32/Cridex [Threat Name] go to Threat

Win32/Cridex.AA [Threat Variant Name]

Win32/Cridex.AA is a trojan that steals passwords and other sensitive information. The trojan serves as a backdoor. It can be controlled remotely.

When executed, the trojan copies itself into the following location:

The %number% represents a random number.

The trojan may create the following files:

In order to be executed on every system start, the trojan sets the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "KB%number%.exe" = "%appdata%\KB%number%.exe"

The following Registry entries are created:

A string with variable content is used instead of %variable% .

After the installation is complete, the trojan deletes the original executable file.

The trojan collects sensitive information when the user browses certain web sites.

The trojan collects the following information:

The trojan attempts to send gathered information to a remote machine.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (16) URLs. The HTTP protocol is used.

It can execute the following operations:

The trojan creates and runs a new thread with its own program code in all running processes.

The trojan hooks the following Windows APIs: