RMF_FN - Malware Gallery

Informations

From	Poland
Author	ZENEK
Family	RMF_FN
Category	Remote Access
Version	RMF_FN
Released Date	Apr 2000, 24 years, 7 months ago.
Language	Delphi

Additional Information

Server:
C:\WINDOWS\SYSTEM\OLE32.EXE 

size: 212.732 bytes

port: 8888 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "OleLoader"

Author Information / Description

R M F _ F M B A C K D O O R    V E R S I O N 1 . 1    B E T A    III


---------------------------------------- N O T E ------------------------------------------------

                                   For educational only

---------------------------------------- N O T E ------------------------------------------------



1. Introduction
	RMF_BACKDOOR V1.1 BIII is a trojan horse with GUI (Graphical User Interface)
   It makes possible full control infected computer.
   This trojan was written under DELPHI 5.0 PROFESSIONAL.

2. How to infect computer
	To infect computer you must execute SETUP.EXE which is working under WIN 95/8
        (Windows 2000 not tested yet). Executed server is being copied into WINDOWS/SYSTEM
        directory (typical C:\WINDOWS\SYSTEM) then it's modifing registry (adds path to SETUP.EXE
        in /RUN section).Server exectes while WINDOWS is starting.

3. Features
   - IP Scanning  //Built-in IP scanner
   - Visual tricks //Built-in screen-saver
   - Access to disks (downloading and executing)
   - Screen grabbing //Built-in viewer

4. RMF.ZIP includes
   - RMF.EXE    //Trojan client
   - SETUP.EXE  //Trojan server
   - README.TXT //This file
   - SOURCE.ZIP //Full source code

5. Source code modifications
	Modifications are advisable but don't modify trojan name and "About"  section in
   client  - PLEASE


RMF_FM is registred trademark of RADIO MUZYKA FAKTY LTD. //Best polish radio

Copyright (C) by ZENEK