KWM (b)
(Backdoor.Win32.KWM.b)

by ?

Written in Delphi

Released in October 2001

more versions


Dropped File:
c:\WINDOWS\netcfgh.exe 

size: 70.656 bytes

port: 
all connecting to ip 209.202.156.236 port 21 TCP

startup:
c:\windows\system.ini

added:
c:\contract.txt 

remarks:
The server shows a txt file with a
CONTRACT FOR SERVICES
from
Billing Systems SAC
Av. Larco 1183
Lima 18
Peru

MegaSecurity