Iniquity-Rat 1.1
(Not detected by KAV on January 08, 2007)

by Lycaon

Written in Delphi

Released in November 2002

Made in Suriname

more versions




Server:
dropped files:
c:\WINDOWS\SYSTEM\msgsrv16.exe
size: 614.400 bytes 

startup:
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run "msgsrv16 update"
data: C:\WINDOWS\SYSTEM\msgsrv16.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "msgsrv16 update"
data: C:\WINDOWS\SYSTEM\msgsrv16.exe 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "msgsrv16 update"
data: C:\WINDOWS\SYSTEM\msgsrv16.exe 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "msgsrv16 update"
data: C:\WINDOWS\SYSTEM\msgsrv16.exe 

port: 7776 TCP



tested on Windows 98
May 08, 2005

MegaSecurity