yulihubot 1.5
(Backdoor.Win32.Uhil.f)
(Backdoor.Win32.Agent.ic)

by ?

Compressed with FSG

Released in January 2005

Made in China

more versions


Server:
dropped files;
c:\WINNT\system32\iisinfo.exe  Size: 66,609 bytes 
c:\WINNT\system32\shdocl.dll   Size: 10,752 bytes 
c:\WINNT\system32\smtp.dll     Size: 45,568 bytes 
c:\WINNT\system32\wupdata.exe  Size: 66,609 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "UpData"
data: C:\WINNT\system32\wupdata.exe 



tested on Windows 2000
April 30, 2005

MegaSecurity