GhostRadmin Gen 1.0 (a)

Released 21 years, 2 months ago. October 2003

By illwill

Informations

Author	illwill
Family	Ghost Radmin
Category	Webdownloader
Version	GhostRadmin Gen 1.0 (a)
Released Date	Oct 2003, 21 years, 2 months ago.
Language	Assembly

Additional Information

Server:
dropped file:
c:\WINDOWS\system32\AdmDll.dll    size: 35.328 bytes 
c:\WINDOWS\system32\r_server.exe  size: 184.320 bytes 

port: 4899 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_R_SERVER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\r_server\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\r_server\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_R_SERVER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server\Security
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters

tested on Windows XP

Author Information / Description

Ghost Radmin Generator 1.0
Coded by illwill in ASM
10/6/04

Description: ==============================================
 Generates a dropper that silently installs Radmin on a 
 remote computer for win9x/me/nt/2k/xp.
 basically it extracts the radmin server and dll from itself
 and adds the proper registry keys for it to function.
===========================================================
features:
* only 218kb 
* installs radmin with a password that you choose
      (default pass is 12345678 )
* Self-deletes after installing Radmin

Instructions:

1. extract all files from zip to a folder
2. open up GhostRadmin.exe
3. Change the default pass to the password you want
4. press the generate button
5. Radmin.exe will be created in the same directory
6. Send to your victim
7. Enjoy

illwill