by SkullBoy & Dark Moon
Written in Delphi, compressed with UPX
Released in August 2004
Server: dropped file: c:\WINNT\system32\EXPL0RER.EXE size: 27.648 bytes port: 25555, 2600, 1033, 800 TCP startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER" data: EXPL0RER.EXE tested on win2000MegaSecurity