Backdoor:W32/IRCBot.DIG

Threat description

Details

Category: Malware
Type: Backdoor
Platform: W32

Summary

A remote administration tool (RAT) which bypasses normal security mechanisms to secretly control a program, computer or network.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details

This malware may arrive as a file downloaded from a malicious website, or as a message received over an instant messaging application such as MSN messenger, AIM, or AIM Triton.

Execution

Upon execution, the malware will drop a copy of itself into the Windows folder as:

  • %windir%\servicean.exe

It creates an entry in the registry, which allows the malware to start automatically:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Windows svchost = servicean.exe

It then checks the following processes:

  • svchost.exe
  • explorer.exe
  • hidserv.exe
  • winlogon.exe
  • services.exe
  • crss.exe

The malware will search the process memory for the following strings:

  • RFB 003.008
  • RXBot
  • [MAIN]
  • [SCAN]
  • [FTP]
  • NZM
  • scan.stop
  • NZM/ST
  • scanall
  • YaBot

It will terminate the processes in the process memory if found.

Backdoor

It then immediately attempts to connect to a specific channel on a specific IRC server, which the unauthorized remote user is using to access and control any infected machines.

Once connected to the IRC server, the infected machine is ready to accept and execute commands from the remote user. The remote user can perform a variety of actions such as:

  • Enabling or disabling propagation via MSN Messenger
  • Disabling propagation
  • Enabling or disabling propagation via AIM
  • Enabling or disabling propagation via AIM Triton
  • Reporting uptime of the bot
  • Retrieving running threads (its propagation thread like MSN Thread, Bot Killer Thread)
  • Downloading a file from the bot controller
  • Getting updates from the bot controller
  • Killing other bots
  • Launching a process
Network Connections

Attempts to connect to:

  • IRC SERVER: hub.[...]hacksite.us
  • Channel: ##xxxxxx
  • User: 'Currently Logged User Name' : 'Computer Name'





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More