Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Breplibot.AE


Aliases:


Breplibot.AE
Breplibot.AE

Malware
Backdoor
W32

Summary

Breplibot.AE is a backdoor with bot capabilities. It connects to several IRC servers and waits for commands from the backdoor author.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


System installation

The backdoor's file is a PE executable about 30 kilobytes long, packed with UPX file compressor.When the backdoor's file is started, it copies itself as 'svcsvh32.exe' file to Windows System folder and then tries to create the following startup key values in the Registry:

  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  • [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsDiskE" = "svcsvh32.exe"

Bot functionality

When the backdoor is active, it connects to an IRC server, and joins a certain channel then acts as a bot there.The following IRC servers and ports are used by the backdoor:

  • 152.7.4.74:8080
  • 161.6.23.28:8080
  • 170.140.216.236:8080
  • 170.140.240.82:8080
  • 128.119.60.144:8080

The backdoor joins the following password-protected IRC channel:

  • #info

A hacker can send commands to the bots to control infected computers. Several tasks can be performed, including the following:

  • - Download and execute files from remote servers
  • - Request system information
  • - Delete files

Payload

Breplibot.AE tries to terminate several security-related processes.



Detection



Detection Type: PC
Database: 2006-02-01_02





Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free