Dllinjectorini 2021 <QUICK>
Deconstructing "DLLInjector.ini 2021": A Deep Dive into a Legacy Persistence Mechanism
3. YARA Rule for the 2021 Pattern
rule DLLInjector_INI_2021 svchost\.exe
5. Security and Safety Warning
If you have found a file named dllinjectorini.exe or similar in your downloads or on your system, exercise extreme caution.
- False Positives: Legitimate injectors are often flagged by antivirus software as "HackTool" or "Trojan" because they use techniques identical to malware.
- Malware Risk: Many publicly available injectors on forums act as "stub loaders." They perform the injection correctly but may also silently install spyware, keyloggers, or cryptocurrency miners on your PC.
- Game Bans: Using such tools in online games will almost certainly result in a permanent ban from the game's anti-cheat system (e.g., VAC, BattlEye, EasyAntiCheat).
1. Sigma Rules for File Creation
title: Suspicious DLLInjector.ini Creation
status: experimental
description: Detects creation of dllinjector.ini in unusual paths
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: '\dllinjector.ini'
filter:
TargetFilename|startswith: 'C:\Program Files\LegitApp\'
condition: selection and not filter
Typical Structure of the File
Unlike standard Windows .ini files (which are plain text with section headers), the 2021 variant often included obfuscated sections. A reverse-engineered example might look like this: dllinjectorini 2021
[InjectorConfig]
TargetProcess = explorer.exe
DLLPath = C:\Users\Public\svchost_core.dll
InjectionMethod = ThreadHijack
PersistenceKey = HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SleepTime = 45000
EncryptionKey = 0xA3F2_2021
Key Attributes in 2021 Variants:
- TargetProcess: The legitimate process into which the DLL is injected (e.g.,
explorer.exe,svchost.exe, orRuntimeBroker.exe). - DLLPath: Location of the malicious dynamic-link library.
- InjectionMethod: Techniques like
CreateRemoteThread,SetWindowsHookEx, orThreadHijack. - PersistenceKey: Registry run keys or scheduled tasks to reload the injector after reboot.
- EncryptionKey: A hardcoded XOR or RC4 key (the "2021" signature often appeared as part of the key or magic bytes).
