The design of the trojan is odd. According to the Symantec analysis, it did a bunch of xor's on request/replies as a sort of obfuscation. Given the available commands all had GUID "magic numbers", only someone who had analyzed the source code could exploit the backdoor. If one did that, he surely would have observed the xor-ing and could easily add it into his trojan client. If the author wanted to be sure that his botnet was not hijacked, he should have made the trojan check signatures of instructions to verify origin.<p>Perhaps the xors were there to obfuscate the data on the wire so the nefariousness of the open port would not be so obvious to net admins? However, given that most companies would not forward 7777 traffic through their firewalls, this trojan was probably targeted toward home users without firewalls. Or, maybe it was designed as an exploit to be used after another means was used to get inside a corporate firewall?<p>Also, given that probably only a few computers out of a million had this trojan installed with 7777 available on the public 'net, how much effort would be required to portscan machines just to identify botnet members? And, was this even a true botnet? The built-in commands seemed to be designed around data harvesting (for identity theft?).<p>This whole design is very strange to me.