Compressed with ASPack

Made in Ukrainia

more versions

Server:
dropped files:
c:\WINDOWS\system32\dtrIV.dat   size: 5 bytes 
c:\WINDOWS\system32\DtrIVk.dll  size: 8.704 bytes 
c:\WINDOWS\system32\nb004.exe   size: 14.848 bytes 

port: 10001 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "nbsession"
data: nb004.exe 

tested on Windows XP
November 21, 2004