Threat Description

Backdoor:W32/Zapchast

Details

Aliases: Backdoor:W32/Zapchast, Backdoor.IRC.Zapchast, IRC/Zapchast
Category: Malware
Type: Backdoor
Platform: W32

Summary


A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details


This is the Backdoor:W32/Zapchast Family Description.

Installation

Zapchast variants use an mIRC client to create a backdoor that gives an attacker access to, and control over, the infected system. The client itself is detected as Riskware:W32/mIRC (also detected as Client-irc.win32.mirc). By itself, the mIRC client is not malicious. Zapchast and its variants can however use malicious configuration files (detected as Backdoor.IRC.Zapchast) to turn the mIRC-client into a backdoor.

The mIRC client and the necessary files (not all of them may be malicious) are usually dropped somewhere on the hard drive. A registry entry is then created, which starts the mIRC client every time the computer is started.

The mIRC client, which now functions as a backdoor, then joins a predefined IRC channel. Using this channel, the attacker can then issue commands to the backdoor and effectively control the infected system. Sometimes, Zapchast variants will use additional batch files which provide added functionality, such as performing registry changes to create a launchpoint for the backdoor. These auxiliary batch files are detected as Trojan.BAT.Zapchast.

Activity

The mIRC scripting language used to create the malicious configuration files enables the backdoor to do numerous tasks, such as downloading files, acting as a proxy or stealing information by logging keystrokes. The actual functionality of the backdoor depends on the variant in question.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More