Skip to content
1-888-762-8736(M-F 8:00am-5:00pm CST)
1-877-218-7353(M-F 8:00am-5:00pm CST)
href="http://www.trendmicro.com/us/enterprise/index.html" id="ENT-overview-test2" title="SEE ALL ENTERPRISE SOLUTIONS">Enterprise Overview
This malware arrives as a Gadhafi death video spam purporting to come from CNN. When executed, this backdoor sends specific information to the remote server.
To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.
This backdoor downloads an updated copy of itself from a certain website.
This backdoor executes then deletes itself afterward.
This backdoor may be downloaded from the following remote sites:
It injects threads into the following normal process(es):
This backdoor opens the following port(s) where it listens for remote commands:
It connects to any of the following IRC server(s):
It joins any of the following IRC channel(s):
This backdoor connects to the following URL(s) to get the affected system's IP address:
NOTES: Once this backdoor successfully connects to the IRC server, the remote malicious user then issues a command to download an updated copy of the malware.
During the analysis, the server returns the following URL to download a copy of this malware:
It saves the files it downloads using the following name:
Once it successfully downloads the file, this backdoor sends the following information to the remote server:
It may also execute the following commands from a remote malicious user:
This malware contain errors in its code that prevent this backdoor from properly executing its routines, its file structure is severely damaged, and the starting entry of the files point to the wrong address.
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_IRCBOT.DAM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Connect with us on
| | | |