Ducktoy 1.1
(Backdoor.Win32.Ducktoy.11)

by Ycm & Gumi

Written in Delphi

Released in August 2002

Made in Spain

more versions


Server:
dropped file:
c:\WINNT\Explorer .exe  size: 623.616 bytes 

port: 29559, 59211 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MS HTML"
data: C:\WINNT\Explorer .exe 

MegaSecurity