Darkmoon 4.10
(Backdoor.Win32.DarkMoon.u for Server)
(Backdoor.Win32.DarkMoon.40 for Client)

by Shukisnike

Written in Delphi

Released in March 2005

more versions




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE
size: 102,912 bytes 

c:\WINDOWS\system32\SP00LSV.EXE
size: 102,912 bytes 

port: 25555, 800 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE 




tested on Windows XP
March 24, 2005

MegaSecurity