WVM 1.3
(Constructor.Win32.VB.cm)
(Trojan.Win32.VB.bod for Extracted File)

by W32_Cr4Ck3r

Written in Visual Basic

Released in December 2007

Made in Iran

more versions 




Server
Dropped Files:
c:\WINDOWS\system32\Explorer.exe    Size: 26,333 bytes 
c:\WINDOWS\system32\regsvr.exe      Size: 26,333 bytes 

Startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "regsvr"
Data: C:\WINDOWS\System32\regsvr.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "C:\WINDOWS\System32"
Data: C:\WINDOWS\System32\Explorer.exe 



Tested on Windows XP
January 11, 2008
MegaSecurity