Backdoor.Win32.VB.af
(Backdoor.Win32.VB.af)

by Exhumed

Written in Visual Basic, compressed with ASPack

more in this category


dropped file:
c:\WINDOWS\system32\win32.exe
size: 41.472 bytes 

port: 3006 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Microsoft"
data: win32.ex

tested on Windows XP 
December 05, 2004

MegaSecurity