Gh0st RAT 3.5

Gh0st RAT 3.5 Beta
(Trojan.Win32.Dialer.chz for Client)
(Trojan.Win32.Dialer.bjm for Server)
(Trojan.Win32.Dialer.bfs for 6to4ex.dll)

by C.Rufus Security Team

Released in May 2008

Made in China

more versions


Server
Dropped File:
c:\WINDOWS\system32\6to4ex.dll 
Size: 101,419 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 "ImagePath" 
Data: %SystemRoot%\System32\svchost.exe -k netsvcs 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Parameters "ServiceDll" 
Data: C:\WINDOWS\system32\6to4ex.dll 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Parameters "ServiceDll" 
Data: C:\WINDOWS\system32\6to4ex.dll




Tested on Windows XP
August 13, 2008

MegaSecurity