Archive A Reconstructed © MegaSecurity Database

NancyAjram

Released 20 years, 2 months ago. February 2006

By Khaled

Informations

Author	Khaled
Family	NancyAjram
Category	Remote Access
Version	NancyAjram
Released Date	Feb 2006, 20 years, 2 months ago.
Language	Visual Basic

Additional Information

Server:
dropped files:
c:\Security.vbs    Size: 741 bytes 
c:\dlls\ArabicStrip.wma.exe              Size: 49,152 bytes 
c:\dlls\FuckFuckFuck.mpg.exe             Size: 49,152 bytes 
c:\dlls\FuckMovie.wma.exe                Size: 49,152 bytes 
c:\dlls\HotMovie.wma.exe                 Size: 49,152 bytes 
c:\dlls\mailit.vbs                       Size: 895 bytes 
c:\dlls\MissLebanon.jpg.exe              Size: 49,152 bytes 
c:\dlls\MyFirstSex.wma.exe               Size: 49,152 bytes 
c:\dlls\SexCaptured.jpg.exe              Size: 49,152 bytes 
c:\dlls\SexMovie.mpg.exe                 Size: 49,152 bytes 
c:\dlls\SexyArabicGirl.jpg.exe           Size: 49,152 bytes 
c:\dlls\SexyHaifa.jpg.exe                Size: 49,152 bytes 
c:\dlls\SexyLebaneseGirl.jpg.exe         Size: 49,152 bytes 
c:\dlls\SexyNancy.jpg.exe                Size: 49,152 bytes 
c:\dlls\StolenSexVideo.wma.exe           Size: 49,152 bytes 
c:\dlls\WindowsScreen.vbs                Size: 407 bytes 
c:\WINDOWS\
[email protected]
Size: 93 bytes 
c:\WINDOWS\system32\NancyAjram.exe       Size: 49,152 bytes 

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDrives"
data: FF, FF, FF, 03 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoRun"
data: 01, 00, 00, 00 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools"
data: 01, 00, 00, 00 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "NoAdminPage"
data: 01, 00, 00, 00 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp "Disabled"
data: 01, 00, 00, 00 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Ya Salam"
data: C:\WINDOWS\System32\NancyAjram.exe 




tested on Windows XP
June 14, 2006

Author Information / Description

Backdoor/Worm coded by Khaled

functions:
this trojan spreads via irc,network and outlook

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.