Released in July 2006

more versions

Server:
dropped files:
c:\WINDOWS\MoonShadowHook.dat             Size: 60 bytes 
c:\WINDOWS\system32\MoonShadow.dll        Size: 278,216 bytes 
c:\WINDOWS\system32\MoonShadow.exe        Size: 401,408 bytes 
c:\WINDOWS\system32\MoonShadowHook.dll    Size: 57,344 bytes 

added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
old data: Explorer.exe 
new data: Explorer.exe MoonShadow.exe 




tested on Windows XP
August 28, 2006