Exe Pass Stealer
(Trojan.Win32.VB.bwd)

by Five-Three-Nine


Written in Visual Basic

Released in October 2007


Server:
Dropped File:
c:\WINDOWS\scvhost.exe
Size: 32,868 bytes 

Startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "scvhost.exe"
Data: C:\Windows\scvhost.exe 




Tested on Windows XP
October 04, 2007

MegaSecurity