Written in

Released in

Made in China

Default Password: lyy 
Default Port: 9533

Command List:

//exit					
//cmd					
//pslist				
//pskill pid				
//run mode				
//sc query *				
//sc query service			
//sc start service			
//sc stop  service			
//sc remove service			
//ts query				
//ts install port			
//ts set port				
//reboot				
//logooff				
//poweroff				
//clog *				
//clog sys				
//clog app				
//clog sec				
//web					
//path					
//cd					
//dir					
//del					
//rm					
//ren					
//type file				
//sysinfo				
//ca user1 user2			
//cca					
//ftime	file1 file2			
//send message counts			
//help command		

ShadowTear


LyyShell 1.0:
dropped file:
c:\WINNT\system32\ntkernel.exe

size: 38.912 bytes 

port: 9533 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LYY\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LYY\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LYY\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LYY\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LYY\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LYY\Security