Y3K rat 1.4
(Backdoor.Win32.Y3KRat.14.e for Client)
(Backdoor.Win32.Y3KRat.14.a for Server & Editserver)
(TrojanDropper.Win32.Joiner.n)

by -/Chucky-\- and [Firelarm]

Compressed with UPX

Released in October 2000

more versions




Server:
dropped file:
c:\WINDOWS\SYSTEM\Msscmc32.exe
size: 332.800 bytes 

port: 5882, 5884, 5888, 5889 TCP

startup;
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Msscmc32"
data: C:\WINDOWS\SYSTEM\Msscmc32.exe 




tested on Windows 98
February 17, 2005

MegaSecurity