Written in Visual Basic

Released in October 2007

Made in Iran

more versions

 

Server
Dropped File:
c:\WINDOWS\system32\Svchoste.exe
Size: 43,008 bytes 

Port: 11120 TCP

Startup: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
Old data: Explorer.exe 
New data: explorer.exe C:\WINDOWS\system32\Svchoste.exe 



tested on Windows XP
October 16, 2007