Joker 1.0 - Malware Gallery

Informations

From	Germany
Author	Gentleman
Family	Joker
Category	Remote Access
Version	Joker 1.0
Released Date	Mar 2001, 23 years, 9 months ago.
Language	Delphi

Additional Information

Client:
size: 409.600 bytes

MultiClient:
size: 431.616 bytes


Server:
c:\WINDOWS\JOKER.EXE 

size: 159.232 bytes

port: 1337 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "JOKER.EXE"

Author Information / Description

Joker-DDoS-Packet  -  Protocol

                             SourceForge-Version

Commands:                    (Client -> Server)

C1 = Target-IP ... p.ex. "C1 127.0.0.1"
C2 = Packetsize ... p.ex. "C2 200"
C3 = How many Packets do you want to send? ... p.ex. "C3 50"
C4 = Delaytime between Packets ... p.ex. "C4 100"
C5 = Start-Bombing ... p.ex. "C5"
C6 = Server deletes itself ... p.ex. "C6"

Errorcodes:                  (Server -> Client)

E1 = Could not dreate IGMP-Packet
E2 = Could not find target
E3 = Memory Error

Controle-Messages:           (Server -> Client)

MV = On connect Server will send its version ... p.ex. "MV 0.2"
M1 = Server will send an controle message to confirm targetIP... p.ex. "M1 127.0.0.1"
M2 = Server will send an controle message to confirm packetsize... p.ex. "M2 200"
M3 = Server will send an controle message to confirm how many packets it should send... p.ex. "M3 50"
M4 = Server will send an controle message to confirm delaytime... p.ex. "M4 100"
M5 = Shows send Joker is in progress to start bombing... p.ex. "M5"
M6 = Shows that Joker ended bombing-function... p.ex. "M6"

Gentleman