Backdoor:W32/Zapchast

Classification

Malware

Backdoor

W32

Backdoor:W32/Zapchast, Backdoor.IRC.Zapchast, IRC/Zapchast

Summary

A remote administration tool (RAT) that bypasses the security features of a program, computer or network to give unauthorized access or control to its user.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

This is the Backdoor:W32/Zapchast Family Description.

Installation

Zapchast variants use an mIRC client to create a backdoor that gives an attacker access to, and control over, the infected system. The client itself is detected as Riskware:W32/mIRC (also detected as Client-irc.win32.mirc). By itself, the mIRC client is not malicious. Zapchast and its variants can however use malicious configuration files (detected as Backdoor.IRC.Zapchast) to turn the mIRC-client into a backdoor.

The mIRC client and the necessary files (not all of them may be malicious) are usually dropped somewhere on the hard drive. A registry entry is then created, which starts the mIRC client every time the computer is started.

The mIRC client, which now functions as a backdoor, then joins a predefined IRC channel. Using this channel, the attacker can then issue commands to the backdoor and effectively control the infected system. Sometimes, Zapchast variants will use additional batch files which provide added functionality, such as performing registry changes to create a launchpoint for the backdoor. These auxiliary batch files are detected as Trojan.BAT.Zapchast.

Activity

The mIRC scripting language used to create the malicious configuration files enables the backdoor to do numerous tasks, such as downloading files, acting as a proxy or stealing information by logging keystrokes. The actual functionality of the backdoor depends on the variant in question.