TROJ_PROXY.AXA

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any downloading capability.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Dropping Routine

This Trojan drops the following files:

• %User Temp%\mafcss.exe - also detected as TROJ_PROXY.AXA
• %User Temp%\{random}.doc - Normal Document
• %User Profile%\APPLICATION DATA\MICROSOFT\Plugins\ntuser.n1s - Proxy Configuration File

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Download Routine

This Trojan does not have any downloading capability.

Information Theft

This Trojan accesses the following site to download its configuration file:

• http://{BLOCKED}ber.{BLOCKED}gga.net/_vti_y1/index.html?{random characters}
• http://{BLOCKED}sa.{BLOCKED}rli.net/_vti_y1/index.html?{random characters}

Other Details

However, as of this writing, the said sites are inaccessible.

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.