Troj/Haxdoor-DJ is a backdoor Trojan for the Windows platform.
Troj/Haxdoor-DJ runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
Troj/Haxdoor-DJ includes functionality to:
- stealth its files, processes, registry entries and services
- prevent itself being terminated
- prevent itself being deleted
- disable other software, including anti-virus, firewall and security related applications
When Troj/Haxdoor-DJ is installed the following files are created:
<System>\kgctini.dat
<System>\nmk4.dat
<System>\qo.dll
<System>\qo.sys
<System>\ufgrbe.sys
<System>\utgrbe.dll
<System>\utgrbe.sys
The files qo.dll, qo.sys, ufgrbe.sys, utgrbe.dll and utgrbe.sys are detected as Troj/Haxdor-Fam.
The files kgctini.dat and nmk4.dat are not malicious data file and can safely be deleted.
The following registry entries are created to run code exported by utgrbe.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
DllName
utgrbe.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
Startup
XFJS0af2ex
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\utgrbe
Impersonate
1
The file ufgrbe.sys is registered as a new system driver service named "ufgrbe", with a display name of "IPSTK driver". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\ufgrbe