Archive Helmet Icon Archive A Reconstructed © MegaSecurity Database

Wisdom (aa)

Copyright © MegaSecurity

By ?


Informations
Author ?
Family Wisdom
Category Remote Access
Version Wisdom (aa)
Language C++, source included
Additional Information
dropped file:
c:\WINDOWS\SYSCFG16.EXE
size: 37,376 bytes 

port: 559 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows System Configuration"
data: C:\WINDOWS\SYSCFG16.EXE 



tested on Windows XP
February 23, 2007

Author Information / Description
commands:
  "*" beside a command means it isnt working correctly
  *NOTE* MAKE SURE YOU PUT IN CORRECT PARAMATERS, AS THE BOT MAY CRASH IF YOU DONT
  1)  ! version - request version of bot
  2)  ! moo - exit bot
  3)  ! spoof get - get current spoof address
  4)  ! spoof off - disable spoofing from ip, only spoof from current subnet (default)
  5)  ! spoof <ip> - set spoofing to an ip address (this can be used for example with ping, to create a smurf attack, or a syn flood to create a drdos attack)
  6)  ! icmp <ip> <time> - sends random icmp codes to an ip address for an allotted time (512 byte packets + spoofing)
  7)  ! ack <ip> <port> <time> - attacks an ip with ack packets (spoofing, VERY fast sending)
  8)  ! syn <ip> <port> <time> - attacks an ip with syn packets (spoofing, TURBO fast sending)
  9)  ! random <ip> <port> <time> - alternates between syn/ack packets (spoofing, REALLY fast sending)
  10) ! enable <password> - attempts to enable commands on the bot, the password is what you set with the disable command
  11) ! disable <password> - if bot is enabled, disables it, and sets the enable password
  12) ! udp <ip> <port> <time> - sends udp packets (spoofed) to an ip, if port = 0 then it uses random desination ports
  13) ! dns <ip/host> - resolve a host/ip
  14) ! exec <file> [command line] - opens a file (no spaces)
  15) ! uptime - get the system uptime
  16) ! keyspy enable <number between 0 to 15> - enable real time irc based keylogger, the number is used as the colour for the messages (easier to read with many bots)
  17) ! keyspy disable - disable real time irc keylogger
  18) ! delete <file> - delete a file off victims hard disk
  19) ! send <nick> <file> <send as> - sends a file to someone
  20) ! active - returns the active window (usefull if your looking for an interesting screen capture)
  21) ! capture screen <save as> - takes a screen shot
  22) ! capture drivers - list video for windows device(s)
  23) ! capture frame <save as> <index> <width> <height> - captures a frame (bitmap) from a video for windows device
  24) ! capture video <save as> <index> <time> <width> <height> - captures a video (avi) from a video for windows device
  25) ! pscan <subnet> <port> <type> [delay] - scan a subnet for open ports.. if type is 1 then subnet is X, if type is 2 then subnet is X.X, etc..
  26) ! sysinfo - gives you some info about the system
  27) ! raw <command> - sends a raw command to the server
  28) ! dload <http url> <file> [execute] - downloads a file, execute is a boolean of wether to execute
  29) ! clone load <server> <port> - loads 1 clone onto a server 
  30) ! clone kill - disconnects all clones
  31) ! clone raw <command> - sends a raw command to the server
  + you can dcc files to the bot
  + dcc chat console with basic file/process manager
  + socks4 server running on port 559
  + basic plugin system

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.