Released in March 2006

Made in Turkey

Server:
dropped files:
c:\WINDOWS\system32\Crss.exe        Size: 208,386 bytes 
c:\WINDOWS\system32\lusrmgrs.bat    Size: 140 bytes 
c:\WINDOWS\system32\lusrmgrs.exe    Size: 43,008 bytes 
c:\WINDOWS\system32\sregedit.bat    Size: 141 bytes 
c:\WINDOWS\system32\sregedit.exe    Size: 31,744 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "Crss"
data: C:\WINDOWS\System32\Crss.exe 



tested on Windows XP
March 12, 2006