WebCenter 1.0
(Trojan-Spy.Win32.WebCenter.a)

by Nir Sofer

Written in Delphi, compressed with UPX

Released in January 2005

Made in France

more versions


dropped file:
c:\WINDOWS\system32\web.exe
size: 440,832 bytes 

port: 80 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "center"
data: C:\WINDOWS\System32\web.exe 



tested on Windows XP
February 19, 2005

MegaSecurity