SM-PS 1.0
(Trojan.Win32.Scar.xmn)

by Mohammad Mansouri

Written in Visual Basic

Made in Iran




Server
Dropped File:
c:\WINDOWS\system32\soundman.exe
Size: 61,179 bytes 

Startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SOUNDMAN"
Data: C:\WINDOWS\system32\soundman.exe -s 



Tested on Windows XP
September 11, 2008

MegaSecurity