Phoenix2 1.42
(Backdoor.Win32.Phoenix.142)

by C)DMP & Kaosł

Written in Microsoft Visual C++

Released in July 2001

Made in Italy

more versions


Server:
dropped files:
c:\WINDOWS\SYSTEM\w2d7win.exe    size: 10.000 bytes 
c:\WINDOWS\SYSTEM\win32hlp.exe   size: 45.725 bytes 
c:\WINDOWS\SYSTEM\WinRunHelp.wrh size: 4 bytes 

Port: 7410 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "win32hlp"
data: C:\WINDOWS\SYSTEM\win32hlp.exe 

tested on Windows 98
November 18, 2004

MegaSecurity