Dark Moon 4.00 Beta
(Backdoor.Win32.DarkMoon.i.40 for Client)
(Backdoor.Win32.DarkMoon.h for server)

by Shukisnike

Written in Delphi, compressed with UPX

Released in January 2005

more versions


Server 




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE   Size: 71,680 bytes 
c:\WINDOWS\system32\SP00LSV.EXE    Size: 71,680 bytes 

port: 800, 1032, 2600, 25555 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE 



tested on Windows XP
May 03, 2005
MegaSecurity