Written in Delphi & Visual Basic, compressed with PECompact

Released in October 2004

Made in Iran

Server:
dropped files:
c:\WINDOWS\regsvc.exe              size: 22,937 bytes 
c:\WINDOWS\Stub32770.exe           size: 22,937 bytes 
c:\WINDOWS\system32\Agentsvr32.exe size: 22,937 bytes 
c:\WINDOWS\system32\hInstance.dll  size: 0 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8C15971b-RKTP-4c82-8c07-7e181ea07608} "StubPath"
data: C:\WINDOWS\System32\Agentsvr32.exe /hide 


tested on Windows XP
January 04, 2005