iRcHaTaN - PS 7.0
(Trojan-Downloader.Win32.VB.zf)
(Trojan.Win32.VB.uc)

by ?

Written in Visual Basic

Released in June 2005

more versions





dropped files:
c:\WINDOWS\iexplore.exe             Size: 24,199 bytes 
c:\WINDOWS\YMagic.dll               Size: 9,216 bytes 
c:\WINDOWS\system32\iexplore.exe    Size: 24,199 bytes 
c:\WINDOWS\system32\YMagic.dll      Size: 9,216 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ie6"
data: iexplore.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ie6"
data: iexplore.exe 



tested on Windows XP
March 20, 2006

MegaSecurity