sneaker > possibly a beta version of a connect back trojan. > > seems to be able to use a website to transfer information between the > attacker and the infected machine. >
appredir-username=some_irc_guy client version=sneaker_0.19 cmd-url=http://1337suxx0r.ath.cx:580/hack/sneaker/cmd.php=login-url=http://1337s uxx0r.ath.cx:580/hack/sneaker/login.php opfer-info=some_irc_guy /s7regkey={13371337-1337-1337-1337-133713371337} <SubSeven Startup Method (requires Config Setting "s7regkey") m.w _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
