Ducktoy 1.2
(Backdoor.Win32.Antilam.g1 for Server)

by Ycm & Gumi

Clone of  Latinus

Written in Delphi

Released in July 2002

Made in Spain

more versions


Client:
port: 40071 TCP



Server:
dropped file:
C:\WINDOWS\SYSTEM\Explorer.exe 
 
size: 661 KB

port: 29559, 59211 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "MS HTML" 

MegaSecurity