minhaskamal/trojancockroach

1. Project type and runtime

- This is a Windows-only C++ malware sample built around three executables plus two shortcut launchers.

- The architecture targets Windows XP or later and depends on local filesystem access, removable USB drives, and outbound email/HTTP tooling.

2. Main functional split

- The repo is organized into three main behaviors:

- Key/data collection in TrojanCockroach.cpp

- USB-based self-propagation / installation in Infect.cpp

- Post-collection decoding in DecodeMessage.cpp

- Transmit.exe is a bundled transport utility used for sending collected data out.

3. Primary agent: TrojanCockroach.exe

- This is the resident payload that runs on the infected PC.

- It monitors user activity, records keystrokes and related input artifacts, and periodically prepares captured data for transmission.

- It also participates in infecting removable media when a USB drive is inserted.

4. Persistence boundary

- TrojanCockroach.lnk is intended to live in the Windows startup folder, so the payload activates automatically after reboot.

- This creates the persistence layer: startup shortcut → resident trojan process → ongoing capture and spread.

5. Propagation path via USB

- Infect.exe is the spreader component invoked from a disguised shortcut on a removable drive.

- Infect.lnk is renamed to look benign on the USB device; clicking it starts the infection workflow on a new host.

- Once the trojan is active on a machine, insertion of another USB drive triggers copying of the payload bundle onto that drive.

6. Payload staging on removable media

- The infected USB contains a hidden folder holding the full package and a shortcut file that mimics an attractive document or app name.

- This is the handoff boundary between “infected host” and “next host”: the USB acts as the transport medium for the malware bundle.

7. Data capture and local staging

- The trojan accumulates captured text locally before sending it out.

- The README indicates the output contains keylogger noise and repeated patterns, which implies the collected stream is not clean raw text but a mixed event log.

8. Exfiltration path

- Transmit.exe handles outbound transmission of the collected data back to the operator.

- The README identifies it as a bundled Windows distribution of curl, so the exfiltration mechanism is command-line HTTP/email-style transport rather than a custom network stack.

- TrojanCockroach.cpp configures and invokes this transport step.

9. Decode/analysis utility

- DecodeMessage.cpp is not part of the infection chain; it is an operator-side post-processing tool.

- Its role is to turn the email-delivered, character-transformed message back into readable text for manual review and filtering.

10. System-level dependencies

- The design relies on Windows shell behavior for startup shortcuts and removable-drive interaction.

- It also relies on the ability to run companion executables from the same folder, so the package layout is a key part of the architecture.

11. Data flow summary

- User input on infected PC → TrojanCockroach.exe logs data → Transmit.exe sends data out → operator receives encoded message → DecodeMessage.exe converts it to readable text.

- In parallel: infected PC → USB drive gets copied payload → Infect.lnk on USB → new host infection after manual execution.

12. Important architectural boundary

- This repo separates capture, spread, transport, and decode into distinct executables rather than one monolith.

- That separation is the core design choice and is what a diagram should emphasize: resident agent, removable-media propagator, external transport helper, and offline decoder.