RunRat 2004
(Backdoor.Win32.DSNX.04 for builder.exe)

by HEx3d

Written in Visual Basic

Released in March 2004


builder.exe does drop:
c:\WINDOWS\SYSTEM\winuenv.exe 

size: 41.472 bytes
 
port: 113 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinDSNX" 

Connects to a specified IRC server and joins a channel

MegaSecurity