# minhaskamal/trojancockroach architecture
> Architecture diagram of the GitHub repository minhaskamal/trojancockroach, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-27). It is an AI-made overview: check details against the source.
- Interactive diagram: https://gitdiagram.com/minhaskamal/trojancockroach
- Repository: https://github.com/minhaskamal/trojancockroach
## Overview
1. **Project type and runtime**
- This is a Windows-only C++ malware sample built around three executables plus two shortcut launchers.
- The architecture targets **Windows XP or later** and depends on local filesystem access, removable USB drives, and outbound email/HTTP tooling.
2. **Main functional split**
- The repo is organized into three main behaviors:
- **Key/data collection** in `TrojanCockroach.cpp`
- **USB-based self-propagation / installation** in `Infect.cpp`
- **Post-collection decoding** in `DecodeMessage.cpp`
- `Transmit.exe` is a bundled transport utility used for sending collected data out.
3. **Primary agent: TrojanCockroach.exe**
- This is the resident payload that runs on the infected PC.
- It monitors user activity, records keystrokes and related input artifacts, and periodically prepares captured data for transmission.
- It also participates in infecting removable media when a USB drive is inserted.
4. **Persistence boundary**
- `TrojanCockroach.lnk` is intended to live in the Windows startup folder, so the payload activates automatically after reboot.
- This creates the persistence layer: startup shortcut → resident trojan process → ongoing capture and spread.
5. **Propagation path via USB**
- `Infect.exe` is the spreader component invoked from a disguised shortcut on a removable drive.
- `Infect.lnk` is renamed to look benign on the USB device; clicking it starts the infection workflow on a new host.
- Once the trojan is active on a machine, insertion of another USB drive triggers copying of the payload bundle onto that drive.
6. **Payload staging on removable media**
- The infected USB contains a **hidden folder** holding the full package and a shortcut file that mimics an attractive document or app name.
- This is the handoff boundary between “infected host” and “next host”: the USB acts as the transport medium for the malware bundle.
7. **Data capture and local staging**
- The trojan accumulates captured text locally before sending it out.
- The README indicates the output contains keylogger noise and repeated patterns, which implies the collected stream is not clean raw text but a mixed event log.
8. **Exfiltration path**
- `Transmit.exe` handles outbound transmission of the collected data back to the operator.
- The README identifies it as a bundled Windows distribution of `curl`, so the exfiltration mechanism is command-line HTTP/email-style transport rather than a custom network stack.
- `TrojanCockroach.cpp` configures and invokes this transport step.
9. **Decode/analysis utility**
- `DecodeMessage.cpp` is not part of the infection chain; it is an operator-side post-processing tool.
- Its role is to turn the email-delivered, character-transformed message back into readable text for manual review and filtering.
10. **System-level dependencies**
- The design relies on Windows shell behavior for startup shortcuts and removable-drive interaction.
- It also relies on the ability to run companion executables from the same folder, so the package layout is a key part of the architecture.
11. **Data flow summary**
- User input on infected PC → `TrojanCockroach.exe` logs data → `Transmit.exe` sends data out → operator receives encoded message → `DecodeMessage.exe` converts it to readable text.
- In parallel: infected PC → USB drive gets copied payload → `Infect.lnk` on USB → new host infection after manual execution.
12. **Important architectural boundary**
- This repo separates **capture**, **spread**, **transport**, and **decode** into distinct executables rather than one monolith.
- That separation is the core design choice and is what a diagram should emphasize: resident agent, removable-media propagator, external transport helper, and offline decoder.
Main entry points: [`com/minhaskamal/trojanCockroach/TrojanCockroach.cpp`](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/TrojanCockroach.cpp) (TrojanCockroach), [`com/minhaskamal/trojanCockroach/Transmit.exe`](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Transmit.exe) (Transmit.exe), [`com/minhaskamal/trojanCockroach/Infect.cpp`](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.cpp) (Infect tool), [`com/minhaskamal/trojanCockroach/Infect.lnk`](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.lnk) (USB LNK)
## Diagram (Mermaid)
```mermaid
flowchart TD
subgraph group_host["Infected host"]
node_startup_shortcut["Startup LNK
persistence shortcut"]
node_trojan["TrojanCockroach
resident trojan"]
node_input_capture["Input capture
keylogging"]
node_local_staging[("Local staging
log buffer")]
node_usb_trigger(("USB trigger
removable-media hook"))
end
subgraph group_usb["Removable media"]
node_infect_tool["Infect tool
spreader
[Infect.cpp]"]
node_usb_shortcut["USB LNK
disguised launcher
[Infect.lnk]"]
node_payload_bundle[("Payload bundle
hidden package")]
node_usb_drive(("USB drive
transport medium"))
end
subgraph group_operator["Operator side"]
node_transmit["Transmit.exe
transport helper
[Transmit.exe]"]
node_encoded_message["Encoded output
exfiltrated message"]
node_decoder["DecodeMessage
offline decoder
[DecodeMessage.cpp]"]
node_readable_text["Readable text
review output"]
node_operator(("Operator
human analyst"))
end
node_startup_shortcut -->|"auto-starts"| node_trojan
node_trojan -->|"records"| node_input_capture
node_input_capture -->|"buffers"| node_local_staging
node_trojan -->|"invokes"| node_transmit
node_local_staging -->|"feeds"| node_transmit
node_transmit -->|"delivers"| node_encoded_message
node_encoded_message -->|"decodes"| node_decoder
node_decoder -->|"produces"| node_readable_text
node_readable_text -->|"reviewed by"| node_operator
node_trojan -->|"monitors"| node_usb_trigger
node_usb_trigger -->|"copies"| node_payload_bundle
node_payload_bundle -->|"stored on"| node_usb_drive
node_usb_drive -->|"launches"| node_usb_shortcut
node_usb_shortcut -->|"starts"| node_infect_tool
node_infect_tool -->|"installs"| node_payload_bundle
click node_startup_shortcut "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/TrojanCockroach.lnk"
click node_trojan "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/TrojanCockroach.cpp"
click node_infect_tool "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.cpp"
click node_usb_shortcut "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.lnk"
click node_transmit "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Transmit.exe"
click node_decoder "https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/DecodeMessage.cpp"
classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_startup_shortcut,node_trojan,node_input_capture,node_local_staging,node_usb_trigger toneBlue
class node_infect_tool,node_usb_shortcut,node_payload_bundle,node_usb_drive toneAmber
class node_transmit,node_encoded_message,node_decoder,node_readable_text,node_operator toneMint
```
## Components
### Infected host
Windows startup, resident capture, and local staging on the victim machine.
- [Startup LNK](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/TrojanCockroach.lnk): persistence shortcut · Windows Startup-folder shortcut that auto-launches the resident payload. · `com/minhaskamal/trojanCockroach/TrojanCockroach.lnk`
- [TrojanCockroach](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/TrojanCockroach.cpp): resident trojan · Main payload that monitors activity, captures input, stages logs, and triggers USB infection. · `com/minhaskamal/trojanCockroach/TrojanCockroach.cpp`
- **Input capture**: keylogging · Collected keystrokes and related user activity artifacts.
- **Local staging**: log buffer · Temporary accumulation of captured text before transport.
- **USB trigger**: removable-media hook · Host-side logic that reacts when a removable drive is inserted.
### Removable media
USB-based propagation package and launch shortcut.
- [Infect tool](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.cpp): spreader · USB launcher that copies the bundle onto a new drive and starts the infection workflow. · `com/minhaskamal/trojanCockroach/Infect.cpp`
- [USB LNK](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Infect.lnk): disguised launcher · Shortcut placed on the USB drive and renamed to look benign. · `com/minhaskamal/trojanCockroach/Infect.lnk`
- **Payload bundle**: hidden package · Hidden folder on removable media containing the executables and shortcut.
- **USB drive**: transport medium · Removable storage used to move the malware bundle between hosts.
### Operator side
Outbound transport and offline decoding of collected messages.
- [Transmit.exe](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/Transmit.exe): transport helper · Bundled curl-based utility used to send collected data out over HTTP/email-style transport. · `com/minhaskamal/trojanCockroach/Transmit.exe`
- **Encoded output**: exfiltrated message · Operator-facing payload after transmission, still transformed or noisy.
- [DecodeMessage](https://github.com/minhaskamal/trojancockroach/blob/master/com/minhaskamal/trojanCockroach/DecodeMessage.cpp): offline decoder · Post-processing utility that converts the transformed message back into readable text. · `com/minhaskamal/trojanCockroach/DecodeMessage.cpp`
- **Readable text**: review output · Human-readable recovered message for manual review and filtering.
- **Operator**: human analyst · Receives exfiltrated output and reviews decoded content.
## Connections
- Startup LNK → TrojanCockroach: auto-starts · Startup shortcut launches the resident trojan after reboot.
- TrojanCockroach → Input capture: records · The resident payload captures keystrokes and related user activity.
- Input capture → Local staging: buffers · Captured events are accumulated locally before transmission.
- TrojanCockroach → Transmit.exe: invokes · The trojan configures and runs the transport helper for exfiltration.
- Local staging → Transmit.exe: feeds · Staged capture data is handed to the transport step.
- Transmit.exe → Encoded output: delivers · Transport sends the collected data to the operator side.
- Encoded output → DecodeMessage: decodes · Offline tool reverses the character transformation for analysis.
- DecodeMessage → Readable text: produces · The decoder outputs readable text for manual review.
- Readable text → Operator: reviewed by · Operator inspects the recovered content.
- TrojanCockroach → USB trigger: monitors · The resident payload watches for removable-drive insertion events.
- USB trigger → Payload bundle: copies · Infection workflow stages the bundle onto inserted USB media.
- Payload bundle → USB drive: stored on · The malware package resides on the removable drive.
- USB drive → USB LNK: launches · The disguised shortcut is used to start the spreader on another host.
- USB LNK → Infect tool: starts · Clicking the shortcut executes the USB spreader.
- Infect tool → Payload bundle: installs · The spreader copies the package onto the new drive/host boundary.