Which rootkit is described as intercepting the victim's account information before encryption and is installed when the user opens a malicious email attachment or advertisement?

• A. EquationDrug Rootkit
• B. Rootkit Trojans
• C. Banking Trojan
• D. Covert Credential Grabber

Answer: (A)

Intercepting credentials before encryption is about malware that sits in the data path, grabbing login data as it’s entered or just before it’s encrypted and sent over the network. This kind of credential-stealing capability is often delivered via social engineering, with the user tricked into opening a malicious email attachment or clicking a shady ad, which then installs the malware on the system.

This description aligns with the described rootkit because it emphasizes stealthy capture of account information at the moment it would be exposed before any encryption or secure transmission, a hallmark of credential-grabbing rootkit activity. The other options are broader or describe different threat archetypes (general banking trojans, generic rootkit trojans, or non-rootkit credential grabbers) that don’t fit the specific combination of stealthy credential interception and delivery via malicious attachments or malvertising as tightly.