Written in C, compressed with ASPack

more versions

Backdoor.Win32.Loony.k:

dropped file:
c:\WINDOWS\system32\MPL32.exe
size: 18,432 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MPL32 driver"
data: MPL32.exe 	

The binary contains  the text string "Crow 1.2c[Priv-SyN] Modded By Loony".


tested on Windows XP
April 12, 2005