Dewin (b)
(Backdoor.Win32.Dewin.b)

by ?

Compressed with PECompact

more versions


dropped files:
C:\WINDOWS\Winreg.exe     size: 37.376 bytes
c:\WINDOWS\TEMP\temp.bat 
c:\WINDOWS\TEMP\temp.pif 

port: 15553 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\Run 

MegaSecurity