Surila (i)
Copyright © MegaSecurity
By ?
Informations
| Author | ? |
| Family | Surila |
| Category | Remote Access |
| Version | Surila (i) |
| Language | Microsoft Visual C++, protected with SVKP |
Additional Information
dropped files on Win98:
c:\WINDOWS\All Users\Start Menu\Programs\StartUp\dx32cxlp.exe size: 234.496 bytes
c:\WINDOWS\SYSTEM\dx32cxconf.ini size: 17 bytes
c:\WINDOWS\SYSTEM\dx32cxlp.exe size: 234.496 bytes
port (XP): 33370, 33373, 9082 TCP
Added to registry (XP):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DX32CXEL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SVKP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SVKP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DX32CXEL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SVKP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dx32cxel
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SVKP
Added to registry (98):
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer "mutexname"
data: fKGKESA
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer "vers"
data: 4D, 00, 01, 00
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "devsec"
data: C:\WINDOWS\SYSTEM\dx32cxlp.exe
attempts to connect to an IRC server (XP)
tested on Windows XP & 98
January 02, 2005If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.