SeTr
(Backdoor.Win32.Delf.acf)

by ambush

Written in Delphi

Released in August 2003

Made in Czech Republic



Server:
dropped file:
c:\WINDOWS\Fonts\winfont32.exe
size: 160,269 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "winfont32"
data: C:\WINDOWS\Fonts\winfont32.exe 



tested on Windows XP
December 05, 2005

MegaSecurity