Troya 1.3
(Backdoor.Win32.Masot.a)

by Mohammad

Written in Delphi, compressed with PECompact

Released in January 2005

Made in Iran

more versions


Troya v1.3
Server New Features:
- Fixed some unicode bugs.
- Standardized Module Captions.
- File Manager has got no longer limits on depth of navigating folders.
- Fixed "File Not Found" Error on downloading some files.
- Fixed DLL File Download IE Prompt.
- Fixed Email Notification Errors.
- Default Screen Capture Quality decreased from 30%  down to 15%. For increasing transfer speed.
- /windir added to options.
- UserName Added to Header.
- User can change the delay of sending packets. Default: 100 Milliseconds.
- Screen shot will open in a new window when clicked from Header

Edit Server New Features:
- Change Server Icon Added to edit server. Now you can choose any icon for server.
- Default port set to 800. Because with port 80 you cannot realize that victim is really online or not.

Mohammad


Server:
dropped files:
c:\WINDOWS\WinLoaderXP.exe           Size: 270,848 bytes 
c:\WINDOWS\system32\explorer64.exe   Size: 6,144 bytes 

port: 800 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache "C:\WINDOWS\WinLoaderXP.exe"
data: WinLoaderXP 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "GenericHostXP"
data: C:\WINDOWS\WinLoaderXP.exe 




tested on Windows XP
May 03, 2005

MegaSecurity