NetBus


Name: NetBus
Aliases: Sysedit, Backdoor.Netbus, W95.NetBus, Michal,
Ports: 6000, 12345, 12346 (12331 ?) (ports can be changed)
Files: Netbus.zip - 1,063,985 bytes Netb120.zip - 461,947 bytes Netb153.zip - 518,063 bytes Netb160.zip - 525,602 bytes Netb160.zip - 530,620 bytes Netb170.zip - 1,116,873 bytes Netbus1.70esp.zip - Netbus server 1.6 new.zip - 527,205 bytes Michal5.0.zip - Netbus.exe - 424,960 bytes Netbus.exe - 494,592 bytes Netbus.exe - 567,296 bytes Netbus.exe - 599,552 bytes Netbus1.7_pl.exe - 599,552 bytes Client.exe - 599,552 bytes Mycomputer.exe - Hacker411.exe - Netb170.exe - 599,552 bytes Sysedit.exe - 427,008 bytes Sysedit.exe - 473,088 bytes Patch.exe - 472,576 bytes Patch.exe - 494,592 bytes Patch170.exe - 494,592 bytes -infect-.p$ - 132 bytes Wizjatv.exe - Keyhook.dll - 52,224 bytes Keyhook.dll - 54,272 bytes - 47,257 bytes
Created: Mar 1998
Requires:
Actions: Remote Access / Keylogger / Eavesdropper
Registers: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
Notes: Works on Windows 95, 98, NT and 2000. Also with Unix (Linux). There also exists hacked versions of NetBus 2.0 by Atomic Toxic and Azote. ? Source code is available (v 1.53).
Country: written in Sweden
Program: Written in Delphi 3.

© Copyright von Braun Consultants. This information may include technical inaccuracies or typographical errors. If you have any questions or further information about the actual trojan above, please contact Joakim von Braun at <joakim.von.braun@risab.se>