Trilight Zone

[thedark]

This backdoor program is written in Delphi, and packed using UPX. The file is 211520 bytes in size.

The backdoor copies itself to the system directory as spools.exe. It registers this file in the system registry to ensure that the program is launched each time Windows is rebooted.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spools Service Controller" = "C:\WINNT\System32\spools.exe"

The backdoor opens two randomly chosen ports and waits for commands from the remote malicious user. Commands can be used to create files, download them from the Internet, reboot the infected computer, conduct DoS attacks using the victim machine, connect to an IRC server as a bot etc.
The backdoor can also function as a proxy server; this function is activated by a command from the remote malicious user.