When the Hack 'a' Tack server part is launched, it copies itself to the Windows directory with the name Expl32.exe. Registry auto-run keys are added so that the Trojan server part is executed whenever Windows starts. It listens on TCP ports 31785, 31787, 31789, and 31791, and UDP ports 31789, and 31791 for incoming connection.