Archive Helmet Icon Archive A Reconstructed © MegaSecurity Database

Lithium 1.02

Released 23 years, 9 months ago. July 2002

Copyright © MegaSecurity

By Olympus


Informations
Author Olympus
Family Lithium
Category Remote Access
Version Lithium 1.02
Released Date Jul 2002, 23 years, 9 months ago.
Language Delphi
Additional Information
Client:
port: 31382 TCP


Server:
c:\WINDOWS\SYSTEM\Shell32.exe 

size: 19.645 byte

port: 31415, 31416 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Shell32"

Author Information / Description
Lithium Version History
-----------------------

---------------
v1.02
---------------

New Features -

 - Added static scripting variables: $sv_windir,
   $sv_sysdir, $sv_tempdir, $sv_clientdir, $sv_username,
   $sv_compname, $sv_serverip, $sv_serverport, 
   $sv_serveraddr, $sv_serverid, $sv_serverver, 
   $sv_serverpass, $sv_connected, $sv_connecting
 - Added new client cset vars: fileexp.editbox,
   filesearch.editbox
 - Added new scripting functions: deletefile, copyfile,
   movefile, fileexists, readfiletobuffer, writebuffertofile
 - Added fake message box on server start
 - Added options to disable guest account and queries
 - Added save passwords/info to file
 - Added ability to change autostart keyname
 - Added remote dos shell
 - Added more buttons to keylogger sendkeys
 - Added sendkeys to window
 - Added regrab screen on refresh option to screen capture
 - Added CGI notify
 - Added download file from URL
 - Added a few more variables to information plugin
 - Made hide cursor *better*, though it still doesn't work well
 - Server now actually deletes itself on remove
 - Directories are now deleted recursively
 - Added right and left up/down mouse events to screen capture 
   (w00t), just click in the captured image and the click will 
   be simulated server-side

Changes -

 - Made server load winsock 1.1 instead of 2.2 (forgot about this)
 - Keylogger raw memo now logs window changes

Bug Fixes -

 - Removed download/upload negotiation delay
 - ICQ pager strings are now URL encoded
 - Fixed 9x systems displaying 0mhz as CPU speed in queries
 - Blank window names in window explorer are now shown if visible
 - Connected clients listing no longer displays clients who have
   not logged on yet (clearance level 0)
 - Fixed pointer not being freed in registry listing
 - Fixed server not removed from registry on every startup method
 - Fixed execute file not always working properly
 - Double clicking in file scanner now connects to host
 - Hostnames are now resolved in address book

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.