Moqura 1.00
(Backdoor.Win32.Moguran)

by Monk

Released in August 2002

Made in China




Server:
dropped files:
c:\WINDOWS\hget.exe      Size: 4,608 bytes 
c:\WINDOWS\wmgr32.exe    Size: 13,312 bytes 

port: 8999 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "wmgr32"
data: C:\WINDOWS\wmgr32.exe 



tested on Windows XP
December 05, 2005

MegaSecurity