Kraimer 1.2
(Trojan-Spy.Win32.Kraimer.12)
(Sniffer.Win32.IPGrabber)

by icarus

Written in Visual Basic

Released in May 2002

more versions


-KrAIMer 1.2-
By icarus

Function:
---------
KrAIMer is a trojan. It listens on port 6668.
It allows you to connect to the remote computer, using telnet, and view passwords,
view keystrokes, view IMs, reboot, view date/time, bufferoverflows, and sign them off AIM.


How-To:
-------
1) Send the server to someone. 
2) Connect to them on port 6668, using telnet.
3) Get a doobie-snack.


Getting Their IP:
-----------------
USE AN IP STEALER-This tool grabs their IP. There should have been one in this zip file.

USE AIM DIRECT CONNECT-On AIM, goto IM Image Connection. Once connected, goto DOS and type: NETSTAT
This will give you a list of machines that are connected to you.
Their IP will be the one thats on port 4443.

INVITE THEM TO CHAT-KrAIMer will send the infected persons IP to chat every 60 seconds.

ASK-Use this as a last resort.


Note:
-----
This will probably not work if they have a firewall or if their IP is masked.


Stuff:
------
Author-icarus
Language-VB6
File Size-68K
Port-6668
Henway-5 or 6 pounds


Server:
c:\WINDOWS\All Users\Start Menu\Programs\StartUp\AOLStart.exe 

size: 68 KB

port: 6668 TCP

startup:
c:\WINDOWS\All Users\Start Menu\Programs\StartUp

Added:
c:\AOL70.exe 

MegaSecurity