PortHack
(Backdoor.Win32.Delf.yj)

by KaHiN

Written in Delphi

Released in January 2005

Made in Turkey


Usage:
http://127.0.0.1:8080/desktop 
http://127.0.0.1:8080/webcam 


Server:
dropped file:
c:\Documents and Settings\%user%\Local Settings\Temp\dxdiag.scr
size: 35,897 bytes 

port: 8080 TCP

startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "DirectX Diagnostic Tool"
data: C:\DOCUME~1\%user%\LOCALS~1\Temp\dxdiag.scr 
	
	
tested on Windows XP
August 20, 2005

MegaSecurity