MagicLink 2004 4.2
(Backdoor.Win32.CmjSpy.at)
(Backdoor.Win32.CmjSpy.au)
(Backdoor.Win32.CmjSpy.aq)

by cmjsoft

Written in Delphi, compressed with UPX

Released in October 2004

Made in China

more versions 




Server:
port: 1982 TCP

dropped files:
c:\WINNT\system32\hlicense.vxd     size: 52 bytes 
c:\WINNT\system32\m2syadll.dll     size: 63.180 bytes 
c:\WINNT\system32\magic.exe        size: 75.056 bytes 
c:\WINNT\system32\sssdda334342.vxd size: 0 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MagicLinkServer"
data: magic.exe 

tested on win2000
MegaSecurity