Released in December 2005

more versions

Server:
dropped files:

c:\WINDOWS\MoonShadowHook.dat             Size: 60 bytes 
c:\WINDOWS\system32\MoonShadow.dll        Size: 270,024 bytes 
c:\WINDOWS\system32\MoonShadow.exe        Size: 372,736 bytes 
c:\WINDOWS\system32\MoonShadowHook.dll    Size: 57,344 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
old data: Explorer.exe 
new data: Explorer.exe MoonShadow.exe 

tested on Windows XP
January 08, 2005