Mirkov4 - Malware Gallery

Informations

Author	Devine
Family	Mirkov4
Category	Remote Access
Version	Mirkov4
Released Date	Oct 2005, 18 years, 11 months ago.
Language	Microsoft Visual C++. Source included

Additional Information

port: 7887 TCP

startup: none

tested on Windows XP
October 12, 2005

Author Information / Description

Mirkov4 -- remote http administration


                      (actually pronounced "Mirkova")




    1. About Mirkov4
    ----------------

    Mirkov4 is a remote administration tool that operates over http. Any
    standard web browser (IE, Firefox, ...) can be used to perform a wide
    range of operations on the machine running Mirkov4:

        * naviguate through the disk and network drives

        * see the user's desktop, send keys and mouse events

        * download, upload or delete (shred) any file

        * execute arbitrary commands in a given directory

        * display and kill currently running processes


    After starting mirkov4.exe, simply connect to port 7887, for example:

    	http://127.0.0.1:7887/ or  http://192.168.1.28:7887/

    You can also specify another port to listen on, like 7997:

        C:\TEMP>mirkov4.exe 7997


    2. Disclaimer
    -------------

    Mirkov4 is destined to be used as a legitimate remote administration
    tool, and is licensed under the terms of the GNU GPL version 2. (See
    gpl.txt). More specifically:


    3. ChangeLog
    ------------

Version 1.1 released on 2005-10-07:

        * Initial release.


    4. TODO
    -------

        * add basic http authentication
        * show a list of users with LM/NTLM hashes
        * perform auto-installation as a service
        * allow proxy requests, including CONNECT
        * download whole directories in .zip format
        * upload a zip file and uncompress it

Devine