NinjaSpy Trojan 2001 Gold
(Backdoor.Win32.FC.a for Client)
(TrojanDropper.Win32.Juntador.e for Server)

by NinjaSpy

Written in Delphi

Released in December 2001

Made in Brazil

more versions


displayed image by server


Server:
dropped files:
c:\WINDOWS\Locproxy1.exe         size: 26.128 bytes    (Trojan.Win32.ICQPager.a)
c:\WINDOWS\Winbot.exe            size: 26.128 bytes    (Trojan.Win32.ICQPager.a)
c:\WINDOWS\Windows.bat           size: 36.384 bytes 
c:\WINDOWS\Winstart.bat          size: 413.190 bytes   (Backdoor.Win32.Latinus.15.a)
c:\WINDOWS\Desktop\Mylla.jpg     size: 13.680 bytes 
c:\WINDOWS\litmus\msgsrv32.exe   size: 36.384 bytes    (Backdoor.Win32.Litmus.203)
c:\WINDOWS\SYSTEM\ Dllconfig.exe size: 413.190 bytes   (Backdoor.Win32.Latinus.15.a)
c:\WINDOWS\TEMP\Mylla.jpg        size: 13.680 bytes
 
port: 1033, 11831, 29559 TCP 

attempts to connect to an IRC server

tested on Windows 98
November 28, 2004

MegaSecurity