NitroCam
(Backdoor.Win32.Delf.yj)

by Niklaus

Written in Delphi, compressed with FSG

Released in January 2005

Made in Turkey


Usage
http://victim_ip:8080/webcam


dropped file:
c:\Documents and Settings\%user%\Local Settings\Temp\dxdiag.scr
size: 35,897 bytes 

port: 8080 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "DirectX Diagnostic Tool"
data: C:\DOCUME~1\%user%\LOCALS~1\Temp\dxdiag.scr 



tested on Windows XP
January 21, 2006
port: 

MegaSecurity