Magic PS 1.5 SE

Released 20 years, 4 months ago. July 2004

By magic_h2001

Informations

From	Iran
Author	magic_h2001
Family	Magic PS
Category	Information Stealer
Version	Magic PS 1.5 SE
Released Date	Jul 2004, 20 years, 4 months ago.
Language	Delphi

Additional Information

Server:
dropped files:
c:\WINNT\regsvr.exe               size: 14.728 bytes 
c:\WINNT\system32\Tapi32init.dll  size: 3.072 bytes 
c:\WINNT\system32\Tapi32init.exe  size: 14.728 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S} "StubPath"
data: C:\WINNT\system32\Tapi32init.exe 

tested on Win2000

Author Information / Description

----------------
Magic-PS v1.5 SE
----------------
{{ Second Edition }}
released in 30/07/2004

 + Full Supporting win 9x-me-nt-2k-xp-2k3 and LongHorn.
 + Fixed for all languages of yahoo messenger (Chines - Arabic - italic and more....).
 + Fixed for all Versions of yahoo messenger 5x-6x
 + change sender Icon from (jpg or software) to (None icon) after install.
 + Send Windows user name.
 + Send Computer name.
 + EnCode Pass :
   if victim uses Alt+key or Html Codes or Space or Smileys in password you must 
   select this item to Encoding password and when you receive EnCoded password 
   use MPS-Decoder for Decoding password...
 + auto remove older versions of MPS from victim's system.
 + MPS Sender Kernel Coded again in Win32ASM and fastest.....
 - Some Bugs Fixed...
	   
magic_h2001