XControl 3.7.2.1
(Backdoor.Win32.Yurist.g)

by F145h

Written in Assembler, compressed with UPX

Released in May 2005

Made in Russia

more versions


Server:
dropped files:
c:\WINNT\system32\xflasett    Size: 5 bytes 
c:\WINNT\system32\xflash.exe  Size: 24 576 bytes 

port: 18081 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "xflash"
data: xflash.exe 
	
	
	
tested on Windows 2000
May 06, 2005

MegaSecurity