Released in January 2000

Server:
dropped file:
C:\WINDOWS\SYSTEM\HACKSTATE TROJAN.EXE

size: 31,744 bytes

port: 30001 UDP

startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Mirabilis\ICQ\Agent\Apps


tested on Windows 98