Toquito bandito 1.2 (h)
(Backdoor.Win32.Banito.h for Client)
(Backdoor.Win32.Banito.dh for Server)

by stm

Written in Delphi

more versions 





Server:
dropped file:
c:\WINDOWS\winhost32.exe
size: 17,408 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{XL8381D8F2-0288-11D0-9501-00AA00B911tb} "StubPath"
data: C:\WINDOWS\winhost32.exe



tested on Windows XP
December 04, 2005
MegaSecurity