BackConstruction 2.1
(Backdoor.Win32.Nightmare.21)

by P23h

Compressed with ASPack

Released in June 1999

more versions


Server:
dropped file:
c:\WINDOWS\Cmctl32.exe 

size: 177.664 bytes 


port: 666, 5401, 5402 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Shell" 

MegaSecurity