ConsoleDevil 1.0
(Backdoor.Win32.Agent.zk)

by MySelf

Released in May 2006

more versions



2) Features
- Reverse connection
- Firewall bypass (Using Code injection)
- Small serversize: 13kb Unpacked
- Remote Console
- Persistant server
- Web Downloader

3) Manual

Install directory: For the install directory you can use environment variables, for example %systemroot% will be replaced
with C:\Windows,E:\Windows,... there are more aviable like: %SystemDrive%, %Temp%
Notice: Make sure this ends with .exe!

Persistant: If this function is activated the server will be rewritten when deleted and
the process restarted when killed. 
Notice: It could be hard to remove the server from the remote computer!

Injection: The process in that the server should be injected.
Notice: Not all processes work! If you don't know what you are doing leave this on default.

Download: The downloads are stored in the directory the server is installed, for example C:\Windows.
After the download is finished the server will tell you through console output.

MySelf


Server:
dropped file:
c:\WINDOWS\server.exe
Size: 13,385 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ConsoleDevil"
data: C:\WINDOWS\server.exe 




tested on Windows XP
May 17, 2006

MegaSecurity