FirstFantasy Beta 1.1
(Backdoor.Win32.Prosti.eq)

by Amoeba

Released in November 2007

Made in China

more versions


Server
Dropped File:
c:\WINDOWS\F_Server.exe
Size: 62,464 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FIRSTFANTASY_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FirstFantasy_Service\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FirstFantasy_Service\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FIRSTFANTASY_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirstFantasy_Service\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirstFantasy_Service\Security




Tested on Windows XP
December 18, 2007

MegaSecurity