Backdoor.Win32.Delf.ea
(Backdoor.Win32.Delf.ea)

by ?

SOCKS4 version 4A server (beta)

Written in Delphi

more in this category


dropped file:
c:\WINDOWS\system32\ipmon.exe
size: 121,456 bytes 

port: 4667, 9294, 8239 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ipmon.exe"
data: C:\WINDOWS\System32\ipmon.exe 



tested on Windows XP
May 25, 2005

MegaSecurity