Remote Network Maintenance 4.5.2
(Backdoor.Win32.Delf.rc)

by ?

Written in Delphi, compressed with ASPack

Made in China




Server:
dropped files:
c:\WINNT\pcnxeit.ini           size: 373 bytes 
c:\WINNT\system32\service.exe  size: 437.760 bytes 

port: 2351 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "service"
data: C:\WINNT\system32\service.exe

tested on Windows 2000 

MegaSecurity