Written in Delphi

more in this category

message box displayed by backdoor

dropped files:
c:\WINDOWS\0.0           Size: 25 bytes 
c:\WINDOWS\br.dll        Size: 8,270 bytes 
c:\WINDOWS\cftmon.exe    Size: 669,696 bytes 
c:\WINDOWS\mirc.dll      Size: 669,696 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ctfmon"
data: C:\WINDOWS\cftmon.exe 



tested on Windows XP
December 11, 2005