Compressed with PECompact

Made in Korea (?)

more versions

Backdoor.Carufax.d:
dropped files:
c:\WINDOWS\SYSTEM\f~q\fag.exe             size: 31.361 bytes 
c:\WINDOWS\SYSTEM\f~q\usr_crt.dll         size: 180.224 bytes  (TrojanSpy.Win32.Spindel.a)


Added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "~~g" 
data: C:\WINNT\System32\f~q\fag.exe 

port: 15188 TCP

Connects to IRC, joins a channel, and waits for commands. 


The backdoor is related to this site:
www.utility-carfax.com 


tested on Windows 98
December 21, 2004