BackConstruction 2.5
(Backdoor.Win32.Nightmare.25)

by P23h

Compressed with ASPack

Released in July 1999

more versions


Server:
dropped file:
c:\WINDOWS\Cmctl32.exe 

size: 189.440 bytes 


port: 666, 5401, 5402 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Shell" 

MegaSecurity