You can find the information at Wikileaks page.
This is a simple DLL hijacking attack that we have successfully tested against Windows XP,Vista and 7. A DLL named fxsst.dll normally resides in \Windows\System32 and is loaded by explorer.exe. Placing a new DLL with this name in \Windows results in this being loaded into explorer instead of the original DLL. On Windows Vista and above, the DLL‘s reference count must be increased by calling LoadLibrary on itself to avoid being unloaded.
This achieves persistence, stealth, and (in some cases) PSP avoidance.
- Compile your application as .DLL
- Place it in C:\WINDOWS as fxsst.dll
- It will be loaded by explorer.exe - (perhaps killing is enough)
The original file is located in
C:\Windows\System32\fxsst.dll (handles T.30 Fax Protocol), but if you place another DLL called
C:\WINDOWS this one will be loaded instead.
From Vista and above you need admin rights to install the DLL and you have to call LoadLibrary on your own DLL
Loadlibrary("C:\\WINDOWS\\fxsst.dll") to increase the reference count or it will be unloaded with FreeLibrary.