The Unexplained

Released 25 years, 6 months ago. May 1999

By Darkstar

Informations

Author	Darkstar
Family	The Unexplained
Category	Remote Access
Version	The Unexplained
Released Date	May 1999, 25 years, 6 months ago.
Language	Visual Basic

Additional Information

Server: 
dropped files:

port: 29891 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "InetB00st"
data: %trojanpath%\Theunexplained1.0Inetb00st.EXE 


tested on Windows XP
February 14, 2005

Author Information / Description

The Unexplained facts:

 - It has 5 functions:
    - Ping
    - Execute
    - Delete
    - Upload
    - Reboot
 - Server size is 12,5 KBs / 12.800 bytes (ASPacked)
 - Written in VB5
 - Entire Source Code is released
 - Trojan is entirely UDP based including the file transfer
(Sends one chunk, waits for reply, then sends another, and so on...)
I choose UDP so it wouldn't show up in netstat.
(UDP = Bad for large files)
 

Release date: 22nd of May 1999

Darkstar