Threat Description

Deep Throat

Details

Aliases: Deep Throat, Win32.DeepThroat
Category: Malware
Type:
Platform: W32

Summary



Deep Throat is a hacker's remote administration tool, much like the infamous Back Orifice and NetBus tools. Deep Throat allows a hacker to access data and gain control over some Windows functions on remote system.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



Deep Throat tool has client and server parts. The server part is installed on a remote system to be accessed. The server part can be dropped to a TEMP directory with a random name by a special dropper.

On execution the server part installs itself to Windows directory and it will be executed automatically during next Windows startup. The execution command for the server part is written to the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

If Deep Throat server part is released by a dropper it is the dropper that modifies the registry.

The server part hides its process name in Windows task manager. Access to the running server part file is denied by Windows so it can't be removed easily while Windows is running.

The client part allows to control the remote computer system where the server part is installed and active. The client part has a dialog interface which allows to perform tricks on remote system and to receive/send data, text and other information (some features are not implemented in version 1.0).

The client and server parts use TCP/IP protocol to communicate with each other. The client part has an option to scan a range of IP addresses to search for active server part and connect to it.

Below is the list of Deep Throat features:

1. Open and close CD-ROM tray
  2. Show a message box on remote system with optional text
  3. Hide or show Windows taskbar
  4. Start FTP server on port 21 - upload/download files
     (not implemented in v1.0)
  5. Capture screen to JPG image and receive it from remote system
  6. Open optional URLs with browsers on remote system
  7. Turn monitor on/off - send powersave mode commands
  8. Steal passwords (not implemented in v1.0)
  9. Run any program on target system
 10. Run any program on target system in invisible mode
 11. Reboot Windows
 12. Port scanner - to scan for computers with DT server running
 13. Ping remote system - to check if there's a running DT server
 14. Get remote system info

The server and client parts of Deep Throat are packed with NeoLite Windows EXE files compressor that decreases their size considerably and also makes detection of this trojan more difficult.

The client part tries to install two TTF fonts on startup, but if Windows is installed to directory other than C:\WINDOWS\ the fonts are not installed and the main dialog window looks crappy.

Version 1.0 of Deep Throat has bugs that might crash Windows.

See: Back Orifice, NetBus





Technical Details: Alexey Podrezov, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More