Skip to content

Threat Encyclopedia
Export page to PDF
BKDR_IRCBOT.DAM
Malware type: Backdoor
Destructive: No
Platform: Windows 2000, Windows XP, Windows Server 2003
Encrypted: No
In the wild: Yes

Overview


This malware arrives as a Gadhafi death video spam purporting to come from CNN. When executed, this backdoor sends specific information to the remote server.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor downloads an updated copy of itself from a certain website.

This backdoor executes then deletes itself afterward.

Technical Details


File size: 153,728 bytes
File type: EXE
Memory resident: Yes
Initial samples received date: 25 Oct 2011
Payload: Connects to URLs/IPs, Downloads files, Compromises system security, Steals information

Arrival Details

This backdoor may be downloaded from the following remote sites:

  • http://www.{BLOCKED}tinoamerica.com/Gadhafi/video.php
  • http://{BLOCKED}8.{BLOCKED}5.238.133/system/FUD.exe

Installation

This backdoor executes then deletes itself afterward.

It injects threads into the following normal process(es):

  • EXPLORER.EXE

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

  • TCP 1685

It connects to any of the following IRC server(s):

  • {BLOCKED}ro.ru

It joins any of the following IRC channel(s):

  • #infe

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

  • http://api.wipmania.com/

NOTES:
Once this backdoor successfully connects to the IRC server, the remote malicious user then issues a command to download an updated copy of the malware. During the analysis, the server returns the following URL to download a copy of this malware:

  • http://{BLOCKED}8.{BLOCKED}5.238.133/system/FUD.exe

It saves the files it downloads using the following name:

  • %Application Data%\C.exe

Once it successfully downloads the file, this backdoor sends the following information to the remote server:

  • Download URL
  • File size of the downloaded file
  • Executed file
  • Number of download retries

It may also execute the following commands from a remote malicious user:

  • Reset connection
  • Terminates the connection

This malware contain errors in its code that prevent this backdoor from properly executing its routines, its file structure is severely damaged, and the starting entry of the files point to the wrong address.

Solution


Minimum scan engine: 9.200
First VSAPI Pattern File: 8.520.03
First VSAPI Pattern Release Date: 25 Oct 2011
VSAPI OPR Pattern Version: 8.521.00
VSAPI OPR Pattern Release Date: 25 Oct 2011

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_IRCBOT.DAM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.
Analysis By: Michael Cabel

Connect with us on