Remote Shell 1.5
(Backdoor.Win32.Small.gs)

by Impostor

Written in Delphi

Released in February 2006

Made in Iran

more versions




dropped file:
c:\WINDOWS\log.txt
c:\WINDOWS\system32\Backup Center.exe    Size: 31,769 bytes 
c:\WINDOWS\system32\FormControl.cpl      Size: 22,528 bytes 

port: 979 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "InterBase"
data: C:\WINDOWS\System32\Backup Center.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SecurityCenter"
data: C:\WINDOWS\System32\Backup Center.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices "FuckIsrael"
data: C:\WINDOWS\System32\Backup Center.exe 



tested on Windows XP
March 14, 2006

MegaSecurity