Trojan robokop
(Backdoor.Win32.VB.asi)

by ®ØßÖkÖÞ

Written in Visual Basic

Released in April 2006





Server:
dropped files:
c:\WINDOWS\Wallpaper_Robokop.exe
size: 98,304 bytes 

port: 4444, 7773, 7776, 7777, 7779 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "WinXplayer"
data: C:\Documents and Settings\Kobayashi\Desktop\robokop\server .exe 



tested on Windows XP
April 21, 2006

MegaSecurity