Darkmoon 4.11 Beta 2

Darkmoon 4.11 Beta 2
(Backdoor.Win32.DarkMoon.af for Client)
(Backdoor.Win32.DarkMoon.ah for Server)

by Shukisnike

Written in Delphi

Released in May 2005




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE
size: 109,697 bytes 

c:\WINDOWS\system32\Sat_May_07_2005.txt
size: 149 bytes 

c:\WINDOWS\system32\SP00LSV.EXE
size: 109,697 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE 

port: 25555, 800 TCP



tested on Windows XP
May 07, 2005

MegaSecurity