Threat Database Trojans Trojan.Injector.FA

Trojan.Injector.FA

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 9,136
Threat Level: 80 % (High)
Infected Computers: 241
First Seen: September 17, 2012
Last Seen: October 1, 2026
OS(es) Affected: Windows

The detection of Trojan.Injector.FA on your system indicates a potential security threat that requires immediate attention. Trojan-type threats are known for their ability to infiltrate systems and cause various forms of damage, ranging from data theft to system compromise. Understanding the nature of this threat and how it operates is crucial in taking the appropriate steps to remove it and protect your system from future infections.

What Is Trojan.Injector.FA?

Trojan.Injector.FA, as indicated by its name, is categorized as a Trojan-type threat. Trojans are malicious programs that disguise themselves as legitimate software to gain access to a system. Once inside, they can perform a variety of malicious actions, including but not limited to, stealing sensitive information, installing additional malware, and providing unauthorized access to the system. The ".FA" suffix may indicate a specific variant or a sub-classification within the broader category of Trojan injectors, which are known for their ability to inject malicious code into other processes running on the system.

How Trojan.Injector.FA Operates

Trojan.Injector.FA, like other Trojans, operates by deceiving users into installing it on their systems. This can happen through various means, such as downloading and executing malicious files from the internet, opening infected email attachments, or visiting compromised websites. Once installed, it can start its malicious activities, which may include monitoring and logging keystrokes, stealing personal data, or downloading and installing other types of malware. Its ability to inject code into other processes allows it to evade detection and persist on the system even after reboots.

Symptoms of Infection

Symptoms of a Trojan.Injector.FA infection can vary widely depending on its specific payload and the goals of its creators. Common signs include unusual system behavior, such as unexpected crashes, slow performance, or the appearance of unwanted programs and toolbars in your web browser. You might also notice that your system is connecting to the internet without your permission, or that your personal files are being altered or deleted. In some cases, the infection might not exhibit noticeable symptoms immediately, making it harder to detect without the use of security software.

How to Remove Trojan.Injector.FA

  1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools if necessary.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated with the latest definitions to increase the chances of detecting and removing the threat.
  3. Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only remove programs you are sure are malicious or unnecessary.
  4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings. This can help remove any malicious extensions or settings changes made by the malware.
  5. After completing the above steps, reboot your system and perform another full scan to ensure the malware has been completely removed. If the malware is still detected after these steps, you may need to seek further assistance from a security professional.

Conclusion

The removal of Trojan.Injector.FA requires careful and systematic steps to ensure the malware is completely eradicated from your system. It's also crucial to adopt preventive measures to avoid future infections, such as keeping your operating system and software up to date, using strong antivirus protection, avoiding suspicious downloads, and being cautious with email attachments and links. By understanding the threat and taking proactive steps, you can protect your system and personal data from the dangers posed by Trojan.Injector.FA and other malware threats.

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor Detection
AntiVir TR/Injector.204800.34
Kaspersky Trojan.Win32.Yakes.bdfr
McAfee Generic.dx!bg3m
AVG Generic29.BEXY
Fortinet W32/Injector.WSF!tr
AhnLab-V3 Spyware/Win32.Zbot
AntiVir TR/Injector.54784.4
Kaspersky Trojan.Win32.Yakes.bcxc
McAfee Generic.dx!bfz4
CAT-QuickHeal Trojan.Yakes.bcxc
AntiVir TR/Injector.56832.1
Kaspersky Trojan.Win32.Jorik.Lolbot.asf
McAfee Artemis!DADC9C85AE05
Panda Generic Trojan
Fortinet W32/Injector.WGR!tr

File System Details

Trojan.Injector.FA may create the following file(s):
# File Name MD5 Detections
1. 42t42esf.exe 8b467993ff5e2ada86325e076d488c61 13
2. web2net.exe 8acf8b044b8b14d570431fcd52ee897a 2
3. B6232F3AA2D.exe 986ad0b102f3684be98ff242fabeb9e8 2
4. jusched.exe 14564042206b9d8961453c0d49bd0a19 2
5. ropyh.exe f6c67109b06b7102f6bdfaaa7a9e31d4 1
6. 34.exe 25a07d40efb770d71b4fde056e4773dd 1
More files

Analysis Report

General information

Family Name: Trojan.Injector.FA
Signature status: No Signature

Known Samples

MD5: b44ea3fda3d57189aacb6db8128e2fef
SHA1: a158eceb422484dce207c6d2b3b94526be709a74
SHA256: 4744DBC822702B86924BD87EC4CF37795E6198A79DFC790ED730FFF77C8D183F
File Size: 177.15 KB, 177152 bytes
MD5: e37c0c796566c907686713bf2d3af5cc
SHA1: 07b69c174113e6afc7d407331b946cd52b1dbe77
SHA256: 923EE375BA9E78698592E21F2F66E12C4DC6CE57804791FF254F09CA6EABF8F3
File Size: 201.22 KB, 201216 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Company Name AMSWaves Corporation
File Description Rar Actions Plugin
File Version 1.0.4.0
Internal Name ir_Rar_Plugin
Legal Copyright Copyright © 2008-2008 AMSWaves Corporation
Original Filename AMSWRar.lmd
Product Name Rar Actions Plugin
Product Version 1.0.4.0

File Traits

  • 2+ executable sections
  • dll
  • HighEntropy
  • x86

Block Information

Total Blocks: 144
Potentially Malicious Blocks: 18
Whitelisted Blocks: 108
Unknown Blocks: 18

Visual Map

0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? 0 0 0 x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 x 0 x 0 ? x 0 0 x x x 0 x x 0 x 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtProtectVirtualMemory
Show More
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • win32u.dll!NtUserGetKeyboardLayout
  • win32u.dll!NtUserGetThreadState
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a158eceb422484dce207c6d2b3b94526be709a74_0000177152.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\07b69c174113e6afc7d407331b946cd52b1dbe77_0000201216.,LiQMAxHB