Evade 1.0
(Not detected by AVP on September 26, 2004)

by FeraliX

Written in Visual Basic

Released in August 2004

more versions


Notes/Known Bugs
• Server Is Roughly 22.6kb Packed With UPX, 72.1kb Unpacked.
• Keylogger Only Log's Number's & Letter's.
• Once You Disconnect From The Server, It Take's 1-2 Min Till Your Able To Connect Again.
• Several Path Error's In The File Manager. Only Visual, They Don't Effect Anything.
• Couple Bug's In The Remove Server.

FeraliX



Server:
dropped file:
c:\WINNT\system32\WinService.exe

size: 22.663 bytes (packed)
 
port: 9999 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Service Module"
data: C:\WINNT\system32\WinService.exe
 
tested on Win2000

MegaSecurity