Black QQ Robber 2.0 Build1115

Black QQ Robber 2.0 Build1115
(Trojan-PSW.Win32.Delf.nx)
(Trojan-PSW.Win32.QQRob.ahu for Server)
(Trojan-PSW.Win32.QQPass.qq for aaykol.dll)

by ?

Written in Delphi

Released in November 2006

Made in China

more versions


Server:
dropped files:
c:\WINDOWS\system32\aaykol.dll    Size: 39,936 bytes 
c:\WINDOWS\system32\aaykol.exe    Size: 39,352 bytes 
c:\WINDOWS\system32\QQhx.dat      Size: 39,352 bytes 


startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "pnnffo"
data: C:\WINDOWS\System32\aaykol.exe  



tested on Windows XP
November 22, 2006

MegaSecurity