Signature Detail

TROJAN: Subseven

This signature detects the runtime behavior of the spyware Subseven, a remote administration tool. After installation, this spyware obtains the IP address of a host machine, enabling attackers to perform multiple tasks remotely, such as deleting files, adding files, killing processes, scanning screen, recording activities, and extracting passwords.

Extended Description

Subseven is a well-known Trojan with a backdoor capabilities. It enables remote attackers to gain full control over an infected machine without the knowledge of the victim.

References

• CVE: CVE-1999-0660
• URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-1999-0660
• URL: http://www.megasecurity.org/trojans/s/subseven/Subseven_all.html