DarkstRat 2008 2.1
(Trojan-GameThief.Win32.OnLineGames.tiem)
(Trojan-GameThief.Win32.OnLineGames.tnec for System64.dll)

by ?

Written in Delphi

Released in October 2008

Made in China

more versions

 


Server
Dropped Files:
c:\WINDOWS\system32\System64.dat    Size: 72 bytes 
c:\WINDOWS\system32\System64.dll    Size: 296,448 bytes 


Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DarkstSer "ImagePath"
Data: %SystemRoot%\system32\svchost.exe -k netservice 
	
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DarkstSer\Parameters "ServiceDll"
Data: C:\WINDOWS\system32\\System64.dll 
	
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DarkstSer\Parameters "ServiceDll"
Data: C:\WINDOWS\system32\\System64.dll 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DarkstSer "ImagePath"
Data: %SystemRoot%\system32\svchost.exe -k netservice 

Tested on Windows XP
2008, October 27, 2008

MegaSecurity