GWGhost 2.5 A5 with Dropper

GWGhost 2.5 A5 with Dropper
(TrojanDropper.Win32.GwBinder.30.a for SetGhost.exe)
(TrojanSpy.GWGhost.b for gwghost.exe, SCANREGW.EXE & DXInput.dll)
(Backdoor.Win32.GwGirl.25.b for dropped SetGhost.exe)

by Machine_GW

Released in February 2002

Made in China

more versions


SetGhost (239.360 bytes) does drop the followingfiles:
c:\WINDOWS\SYSTEM\Config 
c:\WINDOWS\SYSTEM\DXInput.dll 
c:\WINDOWS\SYSTEM\gwghost.exe 
c:\WINDOWS\SYSTEM\SCANREGW.EXE 
c:\WINDOWS\SYSTEM\SetGhost.exe (185.344 bytes)

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "ScanRegistry" 
Old data: C:\WINDOWS\scanregw.exe /autorun 
New data: C:\WINDOWS\SYSTEM\SCANREGW.EXE /autorun 
 

Server:
c:\WINDOWS\SYSTEM\scanregw.exe 

size: 35.584 bytes

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "ScanRegistry" 
Old data: C:\WINDOWS\scanregw.exe /autorun 
New data: C:\WINDOWS\SYSTEM\SCANREGW.EXE /autorun 

added:
c:\WINDOWS\SYSTEM\DXInput.dll

MegaSecurity