GrayPigeon 2.0 Server v2
(Backdoor.Win32.Delf.afd)

by ?

Written in Delphi

more versions


dropped files:
c:\WINDOWS\G_Server2.0.exe         Size: 293,376 bytes 
c:\WINDOWS\system32\cpoiuyk.dll    Size: 9,728 bytes      (Rootkit.Win32.Vanti.b)

port: 8080 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_GRAYPIGEONSERVER2.0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GrayPigeonServer2.0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\�
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_GRAYPIGEONSERVER2.0\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GrayPigeonServer2.0

tested on Windows XP
February 22, 2006
 
MegaSecurity