Beast 1.92 (a)
compiled march 05, 2003
(Backdoor.Win32.BeastDoor.192.a for Client)
(Backdoor.Win32.BeastDoor.192.d for Server)

by Tataye

Successor of Ulysses

Written in Delphi

Compiled on march 05, 2003

Made in Rumania

more versions




Server:
dropped files:
c:\WINDOWS\SYSTEM\COM\csrss.com 
c:\WINDOWS\SYSTEM\WBEM\msw.com 
c:\WINDOWS\SVCHOST.EXE 

size: 52.736 bytes


port: 666 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{44BB0969-EE51-34CF-BBFA-06AA11F6115C} "StubPath" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "COM Service" 

added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "COMM" 

c:\WINDOWS\SYSTEM\kl.dli 

MegaSecurity