Khe Sanh 2.0
(Backdoor.Win32.KheSanh.20)

by Zakharov

Compressed with PECompact

Released in March 2000

Made in Russia

more versions


Server:
dropped file:
C:\WINDOWS\SYSTEM\TRJP.EXE 

size: 59.392 bytes

port: 12389 TCP
      12389 UDP
	  
startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run 

MegaSecurity