.: IMP-Keylogger 2.0 :.

Additional Details

• Coded by: Amir_Coder
• Version: IMP-Keylogger 2.0
• Released date: Jun 2006, 15 years, 11 months ago.
• Coded in: Delphi
• Family: IMP-Keylogger 2.0
• Category: Information Stealer

MegaSecurity Notes

Server:
dropped files:
c:\WINDOWS\unlite.exe                    Size: 24,546 bytes 
c:\WINDOWS\system32\Display01.dll        Size: 28,672 bytes 
c:\WINDOWS\system32\winnt\service.exe    Size: 24,546 bytes 

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools"
data: 0 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"
data: -1 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Media Center Update"
data: C:\WINDOWS\unlite.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2bf41072-b2b1-21c1-b5c1-0305f4155515} "StubPath"
data: C:\WINDOWS\unlite.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings "Media Center Update"
data: C:\Documents and Settings\%user%\Desktop\Mahdi-Keylogger\Mahdi-Keylogger\server.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableRegistryTools"
data: 0 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr"
data: -1 



tested on Windows XP
June 25, 2006