Beast 1.91 & 1.92(b) server
(Backdoor.Win32.BeastDoor.191 for Client)
(Backdoor.Win32.BeastDoor.192.b for Server)

by Tataye

Successor of   Ulysses

Written in Delphi, compressed with ASPack

Released in January 2003

Made in Rumania

more versions




Server:
dropped files:
c:\WINDOWS\svchost.exe 
c:\WINDOWS\COMMAND\mshiye.com 
c:\WINDOWS\SYSTEM\msoksw.com 

size: 50.782 bytes 

port: 666 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "COM Service" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{42AC0312-EE51-A3CC-EA32-40AA12E6115C} "StubPath" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "COM Service" 

added:
c:\WINDOWS\SYSTEM\oksw.blf 

MegaSecurity