Written in Delphi,compressed with ASPack

Server:
dropped file:
C:\WINDOWS\Vbrun600.exe 

size: 158,208 bytes

port: 1987 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft Visual Basic Runtime 

following url's can be found in the binary:
http://www.extra.hu/deadcow/deadcow.bin
http://www.tar.hu/deadcow/deadcow.bin

probably related to Backdoor.Win32.Feri