RatNet 1.00 2005
(Virus.Win32.Hidrag.a)

by ?

Written in Visual Basic

Released in July 2005

Made in Poland




Server:
dropped files:
c:\WINDOWS\system32\Server.ini     Size: 71 bytes 
c:\WINDOWS\system32\StyleXp.exe    Size: 139,264 bytes 

port: 1255 TCP

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Style"
data: C:\WINDOWS\System32\StyleXp.exe\ 



tested on Windows XP
November 09, 2006

MegaSecurity