WAY 2002 (b)
(Backdoor.Win32.Way.2002.b)

by Phoenix


Client is compressed with ASPack, server with PECompact

Released in July 2002

Made in China

more versions



Client:
port: 8200, 8201, 8202, 8203, 8204 TCP



Server:
c:\WINDOWS\SYSTEM\Kernel32.exe 

size: 312.474 bytes

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "LoadWindowsFile" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "LoadWindowsFile" 


MegaSecurity