EES Gateway 1.2 - Malware Gallery

Informations

Author	RaGe
Family	EES Gateway
Category	Stealth Proxy
Version	EES Gateway 1.2
Released Date	Jan 2005, 19 years, 10 months ago.

Additional Information

Server:
dropped file:
c:\WINDOWS\system32\blah.exe
size: 82,290 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "DllLoader"
data: C:\WINDOWS\System32\blah.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "DllLoader"
data: C:\WINDOWS\System32\blah.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "DllLoader"
data: C:\WINDOWS\System32\blah.exe 

tested on Windows XP
November 09, 2005

Author Information / Description

EES Gateway 1.2 by RaGe
-----------------------

Added Features for 1.2
----------------------
The main addition to EES Gateway is the clientside ability to detect when remote reverse servers have
received an incoming connection or have lost it and connect or disconnect from the local app socket
accordingly. The ability to do this in-client makes syncronization so much better, as before you would
have to constantly check for updates and manually click the Local Connect button or Local Disconnect
button based on notifications alone. 

Fixed an error regarding a notification of events. Also redid the notification system and made it less
ugly. 

Fixed Retrieve Status button disable issue by just allowing users to always have access to the button.

Auto Request Status upon Gate creation. This also makes things far easier to read and removes the users'
need to manually request status updates every time a new Gate is made.

Note: This functionality will not be present in servers that are version 1.0 or 1.1. For the client to
make use of this auto forward connection, the server must send the extra 10th bit along with
notifications. Clients that are 1.0 or 1.1 will not make use of this extra bit and will function as it
did before.


EES CREW