Written in Assembly

Released in October 2003

more versions

Ghost Radmin Generator 1.0
Coded by illwill in ASM
10/6/04

Description: ==============================================
 Generates a dropper that silently installs Radmin on a 
 remote computer for win9x/me/nt/2k/xp.
 basically it extracts the radmin server and dll from itself
 and adds the proper registry keys for it to function.
===========================================================
features:
* only 218kb 
* installs radmin with a password that you choose
      (default pass is 12345678 )
* Self-deletes after installing Radmin

Instructions:

1. extract all files from zip to a folder
2. open up GhostRadmin.exe
3. Change the default pass to the password you want
4. press the generate button
5. Radmin.exe will be created in the same directory
6. Send to your victim
7. Enjoy

illwill


Server:
dropped file:
c:\WINDOWS\system32\AdmDll.dll    size: 35.328 bytes 
c:\WINDOWS\system32\r_server.exe  size: 184.320 bytes 

port: 4899 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_R_SERVER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\r_server\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\r_server\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_R_SERVER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server\Security
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters

tested on Windows XP