Gh0st RAT
(not-a-virus:Porn-Dialer.Win32.Agent.bk)

by C.Rufus Security Team

Released in January 2008

Made in China

more versions 


Server:
Dropped File:
c:\WINDOWS\system32\tcpapi32.dll
Size: 121,856 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IAS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IAS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Security



Tested on Windows XP
February 02, 2008
MegaSecurity