MagicLink 3.1
(Backdoor.Cmjspy.31)

by cmjsoft

Written in Delphi, compressed with UPX

Made in China

Released in January 2004

more versions




Server:
dropped files:
c:\WINDOWS\system32\hlicense.vxd  size: 10 bytes 
c:\WINDOWS\system32\magic.exe     size: 93.520 bytes 
c:\WINDOWS\system32\msysdll.dll   size: 82.636 bytes 

port: 1982 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MagicLinkServer"
data: magic.exe

tested on Windows XP 

MegaSecurity