The Unexplained

Released 25 years, 11 months ago. May 1999

By Darkstar

Informations

Author	Darkstar
Family	The Unexplained
Category	Remote Access
Version	The Unexplained
Released Date	May 1999, 25 years, 11 months ago.
Language	Visual Basic

Additional Information

Server: 
dropped files:

port: 29891 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "InetB00st"
data: %trojanpath%\Theunexplained1.0Inetb00st.EXE 


tested on Windows XP
February 14, 2005

Author Information / Description

The Unexplained facts:

 - It has 5 functions:
    - Ping
    - Execute
    - Delete
    - Upload
    - Reboot
 - Server size is 12,5 KBs / 12.800 bytes (ASPacked)
 - Written in VB5
 - Entire Source Code is released
 - Trojan is entirely UDP based including the file transfer
(Sends one chunk, waits for reply, then sends another, and so on...)
I choose UDP so it wouldn't show up in netstat.
(UDP = Bad for large files)
 

Release date: 22nd of May 1999

Darkstar