Psycho Derek 2.1
(Backdoor.Win32.Derek.21)

by BWSB

Invisible Telnet server

Written in Delphi, compressed with UPX

more versions


Server:
dropped files:
c:\WINDOWS\GEMGV.EXE    Size: 50.176 bytes
c:\WINDOWS\GEMGV.EXE 
c:\WINDOWS\GEMGV.LST 
c:\WINDOWS\SYSTEM\GEMGV.DLL 

port: 8681, 8682 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "(Default)" 

MegaSecurity