WinShell 2.0 - Malware Gallery

Informations

From	China
Author	Mr.Janker
Family	Winshell
Category	Remote Access
Version	WinShell 2.0
Language	Visual C++

Additional Information

Server:
size 6 KB

port: 5277 TCP

Startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Author Information / Description

Invisible telnet server.
Usage:  WinShell [?] [port[@]]

  ?     - this help
  port  - default is 5277
  @     - debug mode

From the above, you could know that if you just want to set WinShell to watch port 23, run: 

C:\>winshell 23 

Of course, if you run "winshell" directly, the winshell will listening default port 5277. 

[Login WinShell]
----------------
use any telnet client program, open host and port as following:

>TELNET host port

If successful, you will see the following message in the telnet box : 

WinShell v2.0 by
[email protected]
- '!' to end, 'Enter' to shell...


now, press '!' key you could terminate the winshell remotely. otherwise, press 'enter' or other key, 
you will enter the remote system command shell. Example in the windows 2000 system: 

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WinShell>

now, you could execute console command freely! :)

Janker