Dark Moon 4.00 Beta 3

Dark Moon 4.00 Beta 3
(Backdoor.Win32.Darkmoon.40 for Client)
(Backdoor.Win32.DarkMoon.j for Server)

by Shukisnike

Written in Delphi, compressed with UPX

Released in February 2005




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE   size: 34,816 bytes 
c:\WINDOWS\system32\SP00LSV.EXE    size: 34,816 bytes 

port: 25555, 800 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE 



tested on Windows XP
February 11, 2005

MegaSecurity