NokNok


Name: NokNok
Aliases: Backdoor.FA, Troj_BckNokNok,
Ports: 21, 166, 661, 666, 667 (ports can not be changed)
Files: NokNok.zip - 1,060,564 bytes Noknok5.zip - 1,075,948 bytes Noknok6.zip - 1,114,112 bytes Noknok 6.0.zip - 1,773,369 bytes Noknok7.zip - 897,437 bytes Noknok7.1.zip - 732,451 bytes Noknok7.2zip - 529,611 bytes Noknok8.0.zip - 504,223 bytes Noknok8.1.zip - 558,759 bytes Noknok8.2.zip - 558,908 bytes Saranwrap.zip - 17,567 bytes Noknok4.exe - 856,016 bytes Noknok5.exe - 1,083,295 bytes Noknok6.exe - 1,381,094 bytes Noknok7.exe - 906,312 bytes Client.exe - 227,328 bytes Client.exe - 281,088 bytes Client.exe - 281,600 bytes Client.exe - 861,696 bytes Client.exe - 1,019,904 bytes Client.ini - 40 bytes Server.exe - 287,232 bytes Setup.exe - 31,744 bytes Setup.exe - 233,984 bytes Setup.exe - 250,880 bytes Setup.exe - 287,232 bytes Setup.exe - 705,024 bytes Setupzipped.exe - 359,790 bytes Securpatch.exe - 285,229 bytes Dllfiles.exe - 323,006 bytes Nneye.exe - 354,304 bytes Nnportscan.exe - 453,120 bytes Winipcfg.exe - 38,912 bytes Ws_ftp95.exe - 348,672 bytes Ws_ftp.dll - 260,096 bytes Saranwrap.cpp - 3,611 bytes Saranwrap.rc - 1,710 bytes Autoexec.b01 - ??? bytes Gui.exe - 309,760 bytes Gui.exe - 497,152 bytes Scanreg.exe - Win.000 - 25 bytes Hosts.ip - 3,008 bytes Internat.exe - Rundll.exe - Ipsconnected.log - ??? bytes Ipsfailed.log - ??? bytes - 501,760 bytes
Created:
Requires:
Actions: Anti-protection trojan / Remote Access / Steals passwords / IRC trojan / Port scanner
Registers: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Notes: Works on Windows 95, 98, ME and 2000. Does NOT work on Windows NT.
Country: written in Lithuania
Program: Written in Borland Delphi 3.0, 4.0 and 5.0.

© Copyright von Braun Consultants. This information may include technical inaccuracies or typographical errors. If you have any questions or further information about the actual trojan above, please contact Joakim von Braun at <joakim.von.braun@risab.se>