Threat Description

Deep Throat

Details

Category: Malware
Platform: W32
Aliases: Deep Throat, Win32.DeepThroat

Summary


Deep Throat is a hacker's remote administration tool, much like the infamous Back Orifice and NetBus tools. Deep Throat allows a hacker to access data and gain control over some Windows functions on remote system.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


Deep Throat tool has client and server parts. The server part is installed on a remote system to be accessed. The server part can be dropped to a TEMP directory with a random name by a special dropper.

On execution the server part installs itself to Windows directory and it will be executed automatically during next Windows startup. The execution command for the server part is written to the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run  

If Deep Throat server part is released by a dropper it is the dropper that modifies the registry.

The server part hides its process name in Windows task manager. Access to the running server part file is denied by Windows so it can't be removed easily while Windows is running.

The client part allows to control the remote computer system where the server part is installed and active. The client part has a dialog interface which allows to perform tricks on remote system and to receive/send data, text and other information (some features are not implemented in version 1.0).

The client and server parts use TCP/IP protocol to communicate with each other. The client part has an option to scan a range of IP addresses to search for active server part and connect to it.

Below is the list of Deep Throat features:

1. Open and close CD-ROM tray   2. Show a message box on remote system with optional text   3. Hide or show Windows taskbar   4. Start FTP server on port 21 - upload/download files      (not implemented in v1.0)   5. Capture screen to JPG image and receive it from remote system   6. Open optional URLs with browsers on remote system   7. Turn monitor on/off - send powersave mode commands   8. Steal passwords (not implemented in v1.0)   9. Run any program on target system  10. Run any program on target system in invisible mode  11. Reboot Windows  12. Port scanner - to scan for computers with DT server running  13. Ping remote system - to check if there's a running DT server  14. Get remote system info  

The server and client parts of Deep Throat are packed with NeoLite Windows EXE files compressor that decreases their size considerably and also makes detection of this trojan more difficult.

The client part tries to install two TTF fonts on startup, but if Windows is installed to directory other than C:\WINDOWS\ the fonts are not installed and the main dialog window looks crappy.

Version 1.0 of Deep Throat has bugs that might crash Windows.

See: Back Orifice, NetBus





Technical Details:Alexey Podrezov, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More