Written in Visual Basic

Released in February 2005

Made in China

Client:
port: 20983, 20989 TCP



Server:
dropped files:
c:\Documents and Settings\%user%\Local Settings\Temp\taskngr.exe
size: 606,208 bytes 

c:\WINDOWS\system32\sass.exe
size: 606,208 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run " AutoUpdate"
data: C:\DOCUME~1\%user%\LOCALS~1\Temp\taskngr.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run " AutoUpdate"
data: C:\WINDOWS\System32\sass.exe 



tested on Windows XP June 14, 2005