Darkmoon 4.11 Beta
(Backdoor.Win32.DarkMoon.af for Client)
(Backdoor.Win32.DarkMoon.ae for Server)

by Shukisnike

Written in Delphi

Released in May 2005

more versions 




Server:
dropped files:
c:\WINDOWS\system32\EXPL0RER.EXE         Size: 42,140 bytes 
c:\WINDOWS\system32\Mon_May_09_2005.txt  Size: 61 bytes 
c:\WINDOWS\system32\SP00LSV.EXE          Size: 42,140 bytes 

port: 25555, 800, 6666 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "EXPLORER"
data: EXPL0RER.EXE 




tested on Windows XP
May 08, 2005
MegaSecurity