Casus 0.0
(Backdoor.Win32.FTP.Casus.00)

by NetKoRSan

Compressed with PEtite

Made in Turkey

more versions


dropped file:
c:\WINDOWS\system32\MSMSRV.EXE
size: 244,741 bytes 

port: 3905 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Msmsgs AutoSrv"
data: C:\WINDOWS\System32\MSMSRV.EXE 


tested on Windows XP
November 17, 2005

MegaSecurity