MMCrackz
(Trojan-Dropper.Dos.Crackz)
(Backdoor.Win32.Netbus.160.a)

by Eric

Released in November 2000

more versions


About MMCrackz - Netbus Patcher. v1
Created by Eric. [email protected]

11-10-2000. 03:20am.


* What is MMCrackz - Netbus Patcher?

MMCrackz - Netbus Patcher is a little proggie that installs the Netbus 1.60 client
(renamed to Wini.exe) in a computer. Yeah, I know... there are lots of other progs
that do the same thing (like whackamole.exe and many others), but  the special thing
about this patcher is that it results clean from an Antivirus check! So you can send
this to someone and he will not detect any strange things about this file, and he
thinks he's safe!

* Why is it 'invisible' to an Antivirus?

That's because I altered the Netbus Patch in a special way, so an Antivirus will never
find the trojan, but when you exec the file, a little DOS prompt will begin the 'Patch
reconstruction' and then installs it, so the Netbus client will reach your victim for
your purposes.

* How does it work?

You just send this file to someone, inquire his IP (there are lots of ways to do this,
but I'm not going to mention any, because it's beyond the scope of this text), and when
it is installed in the victim's PC, you are ready to access his computer with Netbus 1.6.

* How can I trick my victim to run this file? and why is it called 'MMCrackz' anyway?

Well, that's because I recently received a specific petition from someone: he needed
some macromedia products crackz. So I prepared this little 'package' and the trick worked
perfectly! He installed the crackz, and the Netbus patch. So I thought maybe someone out
there would find this useful.

Ask to your victim if he/she would like to have some Macromedia Crackz (BTW, this crackz
can be very helpful) and send him the file mmcrack.exe. This file installs a simple ZIP
file with some Macromedia crackz (in addition to the Netbus client).

* Why did you make this with some boring Macromedia crackz? Can you make it with something
else? And can you make it with other trojan client instead of Netbus 1.6?

Yes, I can make the patcher with any file. It's just that I already prepared this package
with MM crackz and the Netbus 1.6 client, so it's just an example. But if you want this
Patcher with something else, you can request it.


Final note: Netbus is such a great program, use it wisely, don't be a lamer!

Eric


dropped files:
c:\WINI.EXE    Size: 472.576 bytes           (Backdoor.Netbus.160.a)
c:\Crackz\Crackz.zip    size: 34.647 bytes 
c:\Crackz\install.exe   size: 34.001 bytes 
c:\Crackz\install.PIF   size: 967 bytes 
c:\WINDOWS\KeyHook.dll  size: 54.784 bytes   (Backdoor.Netbus.160.a)
c:\WINDOWS\WINI.EXE     size: 472.576 bytes  (Backdoor.Netbus.160.a)

port: 12345, 12346 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WINI"
data: C:\WINDOWS\WINI.EXE /nomsg 

MegaSecurity