Z-demon 1.26 al3raab
(Packed.Win32.CryptExe for Client and EditServer)
(Backdoor.Win32.Zdemon.126 for Server)

by [ZnAsH]

Written in Delphi

Released in December 2005

more versions

 

                                                                              




Server:
dropped file:
c:\WINDOWS\SystemReg.exe
size: 810,496 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SystemReg"
data: C:\WINDOWS\SystemReg.exe 



tested on Windows XP
August 18, 2007
MegaSecurity