Archive Helmet Icon Archive A Reconstructed © MegaSecurity Database

MAYA PWS 1.1

Released 20 years, 5 months ago. November 2005

Copyright © MegaSecurity

By Princeali


MAYA PWS 1.1
Informations
Author Princeali
Family MAYA PWS
Category Information Stealer
Version MAYA PWS 1.1
Released Date Nov 2005, 20 years, 5 months ago.
Language Delphi, compressed with UPX
Additional Information
Server:
dropped file:
c:\WINDOWS\maya.exe         Size: 65,033 bytes 
c:\WINDOWS\sqlserver.dll    Size: 47,616 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Maya "StubPath"
data: C:\WINDOWS\maya.exe 
	
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Maya"
data: C:\WINDOWS\maya.exe 	

tested on Windows XP
December 03, 2005

Author Information / Description
After noticing the first version had many requests and usage , I decided remaking it from scratch.
Making it log more passes uses new methods , less resources , and better firewall bypass technique next to a very clear log.
You would notice in your logs the following chars [M] its uses to separate the usernames from the passwords unlike older Maya version the logs were not so organized and had some problems.
Also I though making the log HTML Colored would be clearer for the user and so on.
You will also Notice some words between 2 [P] this happens when the user paste his username or password using CTRL+V Maya will also Catch it.
PHP script was replaced too now items are logged clearly for each user in Tables , FTP Delivery Method was removed and Replaced by Email , and I have  decided to add a Local delivery method (C:\maya.html)
Also Maya is able to get the IE visited URL and more ,i also Updated the Firewall bypassing technique into FWB#++, so Basically Older Maya users will notice a big difference

Princeali

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.