Darkmoon 4.11 Fixed
(Backdoor.Win32.DarkMoon.af for Client)
(Backdoor.Win32.DarkMoon.ak for Server)

by Shukisnike

Written in Delphi

Released in May 2005

more versions 




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE    Size: 42,627 bytes 
c:\WINDOWS\system32\SP00LSV.EXE     Size: 42,627 bytes 

port: 25555, 800 TCP

startup;
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EX




tested on Windows XP
March 13, 2007
MegaSecurity