Sandra (b)
(Backdoor.Win32.Sandrador.b)

by ?

Compressed with PECompact

more versions


dropped file:
c:\WINDOWS\SYSTEM\q167319.dll
size: 12.288 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "mssvc"

attempts to connect to an IRC server

tested on Windows 98
December 12, 2004

MegaSecurity