Backdoor:Win32/Protux.B!dll

Backdoor:Win32/Protux.B!dll is a backdoor trojan that allows remote access and control to the affected computer. It may be installed by TrojanDropper:Win32/Protux.B.

Installation

Backdoor:Win32/Protux.B!dll is a DLL that may installed on the computer as a service by TrojanDropper:Win32/Protux.B.

Payload

Allows backdoor access and control

Backdoor:Win32/Protux.B!dll opens a port on the infected computer and waits for commands; this allows the remote attacker access to the affected computer. Through this backdoor, Protux can be ordered to perform tasks such as:

• Collect information about the computer and post it to a remote server. Information collected may include:
  • Computer name
  • User name 
  • I.P address
  • Version of windows
  • Drive letters
• Download and execute other malware
• Function as a SOCKS proxy server

Downloads and executes arbitrary files

Backdoor:Win32/Protux.B!dll has been observed downloading additional malware onto the computer. It contacts the domain “checkerror.ucparlnet.com” and downloads an executable to the file location “%TEMP%\pre<random number>.tmp” and launches it. At the time of writing, the aforementioned domain was no longer active.

Analysis by Amir Fouda