.: MAYA PWS 1.0 :.

Additional Details

• Coded by: Princeali
• Version: MAYA PWS 1.0
• Released date: Mar 2005, 17 years, 3 months ago.
• Coded in: Delphi, compressed with UPX
• Family: MAYA PWS
• Category: Information Stealer

MegaSecurity Notes

Client:
dropped file:
c:\WINDOWS\ali.dskn 
size: 39,315 bytes 



Server:
dropped file:
c:\WINDOWS\%server name% 
size: 38,400 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "%server name%"
data: C:\WINDOWS\%server name% 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "%server name%"
data: C:\WINDOWS\%server name%  

tested on Windows XP
March 03, 2005

Author Words

Overview
--------
This is a Passwords Stealer , it runs hidden in background and logs  Usernames and 
passwords from most instant messengers and emails services , you will be notified with
the Stolen Data through FTP and PHP .
The Software includes 2 stubs with different sizes ,both achieves the same work, the
difference is in the Firewall bypassing  Technique included in the stub with 
the larger size

File Specifiques 
-------------
Normal Edition : 18.5 KB (Compressed)
FWB    Edition : 37.5  KB  (Compressed)

Contents :
--------
Editor.exe      [ Enable you to Save your Settings to the Software]
mpws.dll        [Normal Edition of The Software]
mpwsfwb.dll   [FWB Edition of the Software     ]
mayapws.php [PHP Script Used in PHP Parsing]
Readme.txt     [ File that you are reading right now]

Princeali