Original Filename: Sbackup

Written in Visual Basic, packed with PE-Crunch

Made in Czech Republic

more in this category

Backdoor.Win32.VB.y:
dropped file:
c:\WINDOWS\system32\Sbackup.exe
size: 1,756,160 bytes 

port: 65535 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Sbackup"
data: C:\WINDOWS\System32\Sbackup.exe 



tested on Windows XP
April 12, 2005