F-Secure
Tools
Backdoor:W32/IRCBot.GNS
| Name : | Backdoor:W32/IRCBot.GNS |
| Detection Names : |
Backdoor:W32/IRCBot.GNS Backdoor.Win32.IRCBot.dig Backdoor:W32/IRCBot.GNS |
| Aliases : |
Worm/IrcBot.96950 (Avira) Worm:Win32/Pushbot.EA (Microsoft) |
| Size: | 96950 |
| Category: | Malware |
| Type: | Backdoor |
| Platform: | W32 |
Summary
Backdoor:W32/IRCBot.GNS is a backdoor trojan.
Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.
Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.
Additional Details
Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.
When executed it will create a copy of itself in the following location:
Note: %windir% is the Windows directory, usually C:\Windows\
It creates a registry launchpoint to start itselt on system startup.
The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:
The presence of outbound network traffic to this address is a symptom of infection.
It creates this value:
It creates this file:
Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:
When executed it will create a copy of itself in the following location:
• %windir%\mservice.exe
Note: %windir% is the Windows directory, usually C:\Windows\
It creates a registry launchpoint to start itselt on system startup.
The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:
• http.xn--mg-kka.com:[REMOVED]/TCP
The presence of outbound network traffic to this address is a symptom of infection.
It creates this value:
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MSN = C:\Windows\mservice.exe
MSN = C:\Windows\mservice.exe
It creates this file:
• %windir%/mservice.exe
Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:
• DDOS a specific IP
• Download and execute arbitrary files
• Spread via MSN or AIM protocols
• Retrieve IE stored passwords on the infected system
• Updates itself