Upon execution, the file detected as Trojan-Proxy.Win32.Xorpix.ar will drop DLL files with the following filenames:

• bot.dll
• dn.dll
• partneship.dll

It will then create the following registry entries:

• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotify\%dll_name%reg
  DllName "C:Documents and SettingsAll UsersDocumentsSettings\%dll_name%.dll"
  Startup "%dll_name%reg"
  Impersonate dword:00000001
  Asynchronous dword:00000001
  

Note: %dll_name% represents the filename of the dropped DLL.

Here are the registry entries:

• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifypartnershipreg
  DllName "C:Documents and SettingsAll UsersDocumentsSettingspartnership.dll"
  Startup "partnershipreg"
  Impersonate dword:00000001
  Asynchronous dword:00000001
• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifynreg
  DllName "C:Documents and SettingsAll UsersDocumentsSettingsn.dll"
  Startup "bnreg"
  Impersonate dword:00000001
  Asynchronous dword:00000001
• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotifyotreg
  DllName "C:Documents and SettingsAll UsersDocumentsSettingsot.dll"
  Startup "botreg"
  Impersonate dword:00000001
• Asynchronous dword:00000001
  

Xorpix.AR will then inject its code to the process Winlogon.exe. It then opens an instance of Internet Explorer and uses a random port to act as a proxy server.

Last update 20 June 2007

 

TOP