ProtG 1.06
(Backdoor.Win32.Agent.oz )
(Backdoor.Win32.Small.hj)

by Gangrel

Written in C++

Released in December 2005

more versions





Server:
dropped file:
c:\WINDOWS\lsass.exe
size: 48,331 bytes 

port: 8999 TCP

added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ServTcp"

tested on Windows XP
January 24, 2006

MegaSecurity