Name :	Backdoor:W32/IRCBot.AAS
Detection Names :	Backdoor.Win32.IRCBot.AAS
Category:	Malware
Type:	Backdoor
Platform:	W32

A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

This IRCBot connects to an IRC server at dark.bestunix.org, where it waits for commands from a remote user. The bot is controlled via messages sent to it.

Installation

Upon execution, Backdoor.Win32.IRCBot.AAS drops a copy of itself in the Windows System directory as:

This program takes advantage of the MS06-040 vulnerability. A specially crafted packet is embedded in the body of the program and is XOR'ed by 99h. The program will then wait for a "Scan" command from a remote user.

On receiving the command, the program sends the packet to all IP addresses that the remote user specifies. The payload of the packet is that it downloads a file from a URL and executes it. The URL the file is downloaded from is:

The file downloaded is detected as Backdoor.Win32.IRCBot.WT.

Activity

This malware connects to an IRC server and joins the password-protected channel #!e!, using a random nickname. It then waits for commands from a remote user.

To be able to gain access to the backdoor, the remote user must login to the channel and type the password:

When successfully logged in to the BOT, the remote user can do the following IRC commands:
The remote user can also perform the following system commands:
Registry This program creates the following registry key as its auto-start technique:
Note: %systemdir% is typically "C:\Windows\system32".