Subject: [Full-Disclosure] Some suspicious files

[morning_wood]

sneaker

> possibly a beta version of a connect back trojan.
>
> seems to be able to use a website to transfer information between the
> attacker and the infected machine.
>

appredir-username=some_irc_guy
client version=sneaker_0.19
cmd-url=http://1337suxx0r.ath.cx:580/hack/sneaker/cmd.php=login-url=http://1337s
uxx0r.ath.cx:580/hack/sneaker/login.php
opfer-info=some_irc_guy
 /s7regkey={13371337-1337-1337-1337-133713371337}
<SubSeven Startup Method (requires Config Setting "s7regkey")

m.w