Sweet Heart 1.0 (b)
Released 21 years, 9 months ago. December 2002
Copyright © MegaSecurity
By huaxingin & tengzhenin
Informations
| From | China |
| Author | huaxingin & tengzhenin |
| Family | SweetHeart |
| Category | Remote Access |
| Version | Sweet Heart 1.0 (b) |
| Released Date | Dec 2002, 21 years, 9 months ago. |
| Language | Delphi |
Additional Information
Client:
size: 585.216 bytes
port: 2101, 2222 TCP
Servers:
c:\WINDOWS\SYSTEM\GIRL.EXE
C:\WINDOWS\TEMP\RunDll.exe
size: 247.296 bytes
port: 6711, 1133, 1183, 8311 TCP
startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "(Default)"
HKEY_CLASSES_ROOT\txtfile\shell\open\command "(Default)"
added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system "DisableRegistryTools"
added files:
c:\WINDOWS\SYSTEMdesktop.ini
c:\WINDOWS\SYSTEMfolder.htt
c:\WINDOWS\SYSTEM\GIRL.EXE
c:\WINDOWS\SYSTEM\WinPlayer.EXE
c:\WINDOWS\TEMP\desktop.ini
c:\WINDOWS\TEMP\folder.htt
C:\WINDOWS\TEMP\RunDll.exeIf you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.