Vagr Nocker Slim 5.0
(Backdoor.Win32.Delf.wl for Client)
(Backdoor.Win32.VagrNocker.112 for Server)

by cyberpaky

Written in Delphi

Released in April 2003

Made in Pakistan

more versions


Server:
dropped files:
c:\WINDOWS\winsckhlpr.exe 
c:\WINDOWS\SYSTEM\winhlpexec.exe 

size: 28.672 bytes 

port: 9999 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "winhlpexec.exe" 
c:\windows\system.ini, [boot] "shell" 

MegaSecurity