Dark Moon 3.0
(Backdoor.Win32.DarkMoon.c for client)
(Backdoor.Win32.DarkMoon.h for server)

by Shukisnike

Written in Delphi, compressed with UPX

Released in November 2004

more versions 




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE size: 30.720 bytes 
c:\WINDOWS\system32\SP00LSV.EXE  size: 30.720 bytes 

port: 25555, 2600, 800 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE

tested on Windows XP
November 08, 2004
MegaSecurity