TROJ_PROXY.EWI

This Trojan may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not drop any other file.

It does not have any downloading capability.

It does not have any information-stealing capability.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
Type = "272"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
ImagePath = "{malware path}\{malware file name}.{extension}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
DisplayName = "Windows Detections"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection
Description = "Provide Windows Detection"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection\Enum
0 = "Root\LEGACY_ALERTER_DETECTION\0000"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection\Security

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Alerter Detection\Enum

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000\Control

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION
NextInstance = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000
Service = "Alerter Detection"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000
Legacy = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000
ConfigFlags = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000
Class = "LegacyDriver"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000
DeviceDesc = "Windows Detections"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Enum\Root\LEGACY_ALERTER_DETECTION\
0000\Control
ActiveService = "Alerter Detection"

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Dropping Routine

This Trojan does not drop any other file.

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

It will listen to the following port in which it serves as a way before responding a connection:

• 1533

It provides a connection to the following IP address:

• {BLOCKED}.{BLOCKED}.238.178:443

It does not have rootkit capabilities.

It does not exploit any vulnerability.