Vagr Nocker 3.0
(Backdoor.Win32.Latinus.14 for Editserver)
(Backdoor.Win32.Antilam.g1 for Server)
(Backdoor.Win32.VagrNocker.20 for Client)

by cyberpaky

Written in Delphi

Clone of  Latinus

more versions 


Server:
dropped file:
C:\WINDOWS\mprtml.exe 

size: 448 KB

port: 12345, 23456 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "MprHTML"
MegaSecurity