Hav-RAT 1.0
(Backdoor.Win32.Havar.c)

by Havalito

Written in Delphi, Source included

Released in December 2006

Made in Sweden

more versions


Server:
dropped file:
c:\WINDOWS\userset.exe
size: 567,808 bytes 

port: 196 TCP

added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Userset"
data: C:\windows\userset.exe 
	
	
tested on Windows XP
December 22, 2006

MegaSecurity