{
  "family": "protux",
  "sample_count": 33,
  "category": "rat",
  "description": "Protux (classified across security research and vendor threat catalogs under signatures including Backdoor:Win32/Protux, Trojan:Win32/Protux, and Backdoor.Protux) is a modular Windows remote access trojan and backdoor active in espionage and cybercrime operations since 2007. Arriving via weaponized email attachments, exploit kits, or pirated software archives, Protux establishes persistence by writing startup entries to the Windows registry and installing a covert background service. Once initialized, Protux opens an encrypted reverse TCP communication session to remote command-and-control (C2) servers. Protux grants remote threat actors complete administrative control over the infected host, providing capabilities such as arbitrary command execution via cmd.exe, interactive file management, keystroke logging, screen surveillance, gathering system hardware configurations, and downloading additional malicious payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Protux",
    "Trojan:Win32/Protux",
    "Backdoor.Protux",
    "Win32/Protux",
    "Trojan.Protux",
    "Backdoor:Win32/Protux.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Protux?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Protux is a modular Windows remote access trojan (RAT) that enables attackers to execute commands, steal files, and monitor victim endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Protux achieve persistence on infected hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows CurrentVersion\\Run registry keys and registers custom background system services to launch upon boot."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance modules does Protux include?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Protux includes keystroke logging hooks, automated desktop screenshot capture, and hardware profile enumeration."
      }
    },
    {
      "@type": "Question",
      "name": "How does Protux communicate with its controller?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes outbound reverse TCP connections over designated ports using customized XOR encryption to mask command traffic."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended remediation actions for Protux?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected machine from the network, terminate unauthorized injected processes, delete persistence registry keys and services, and rotate corporate credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2007,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "P2P Software Downloads & Cracks",
    "Web Exploitation Frameworks"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Remote Interactive Command Shell",
    "File System Navigation & File Transfer",
    "Keystroke Logging & Screen Capture",
    "Encrypted Reverse TCP C2 Session",
    "Registry Manipulation & Process Termination"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound TCP connections to non-standard ports (such as 4433 or 8000) using custom XOR-encrypted packet headers",
      "Periodic keepalive heartbeat packets exfiltrating host hostname, IP address, and logged-in user privileges"
    ],
    "evasion_techniques": [
      "Injecting backdoor worker threads into explorer.exe or services.exe",
      "Dynamic API resolution via LoadLibraryA and GetProcAddress to foil static import detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4",
      "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ProtuxSvc",
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\ProtuxService"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\protux.dll",
      "%AppData%\\Protux\\protux.exe",
      "%Temp%\\ptx_log.dat"
    ]
  },
  "defensive_measures": [
    "Monitor outbound network traffic for anomalous encrypted TCP sessions on non-standard ports",
    "Enforce endpoint detection and response (EDR) rules to detect injection into explorer.exe and services.exe",
    "Restrict regular user accounts from creating or modifying Windows services"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Protux",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Protux"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Protux",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Protux.A",
      "Backdoor:Win32/Protux.B"
    ]
  },
  "motivation": "Unauthorized Remote Administration, Espionage & Data Exfiltration",
  "sample_hashes": []
}