by Princeali
Released in April 2008
Server
Dropped files:
c:\WINDOWS\system32\windows\ali.exe Size: 56,142 bytes
c:\WINDOWS\system32\windows\bhookpl.dll Size: 1,888 bytes
c:\Documents and Settings\%user%\Cookies\[email protected][1].txt
Added to Registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Bandook"
Data: C:\WINDOWS\system32\windows\ali.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1} "StubPath"
Data: C:\WINDOWS\system32\windows\ali.exe
Tested on Windows XP
August 03, 2008
MegaSecurity