TROJ_POXTERS.JK

This Trojan may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {Current folder}\{Current file name}.log - contains logs of its routines

Other Details

This Trojan requires the following additional components to properly run:

• {Current Directory}\{File name}.ini <- contains the parameters of some of the functions needed by the malware
• File to be loaded as service pointed as a parameter from the .ini file

It does the following:

• Checks for arguments present in its execution:
  • -i <- install the file supplied as a parameter by the .ini file as service
  • -u <- uninstall the file supplied as a parameter by the .ini file as service
  • -b <- makes the service visible as a running process
  • -r <- restart the service
  • -k <- kill the service
  • No Argument <- checks the parameter in the .ini file if the malware will restart the process or not
• Names its service: "XYNTService"
• Log its activities onto its log file