TNT 1.1
(Backdoor.Win32.VB.pq for winsock.exe)
(Backdoor.Win32.VB.qr for Server)

by Mr Hawk

aka TelNet Trojaner, capable of disabling anti-virus programs

Written in Visual Basic, compressed with UPX

Released in March 2004

Made in Germany

more versions


Server:
dropped file:
c:\WINDOWS\win32TN\win32TN.exe 

size: 98.380 bytes

port: 23 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MSNet "(Default)"

MegaSecurity