DarkFace 2.1
(Not detected by KAV on February 13, 2008)

by Killerbeat

Base on Source of  MoonPie 1.4

Written in Delphi

Released in June 2002

Made in Germany

more versions


Server:
Dropped files:
C:\WINDOWS\system\lol.exe 
C:\WINDOWS\system\systray.exe.jkl 

size: 899.583 bytes

port: 25686, 25982 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "lol" 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "SystemTray" 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "lol" 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "SystemTray" 


Added:
HKCR\jklfile\shell\open\command 
MegaSecurity