Home / malware

PDF

Backdoor:W32/IRCBot.GNS

First posted on 25 June 2008.
Source: SecurityHome

Aliases :

There are no other names known for Backdoor:W32/IRCBot.GNS.

Explanation :

Backdoor:W32/IRCBot.GNS is a backdoor trojan.

Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.

right]Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

• %windir%mservice.exe

Note: %windir% is the Windows directory, usually C:Windows

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

• http.xn--mg-kka.com:[REMOVED]/TCP
  

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

• HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
  MSN = C:Windowsmservice.exe
  

It creates this file:

• %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

• DDOS a specific IP
• Download and execute arbitrary files
• Spread via MSN or AIM protocols
• Retrieve IE stored passwords on the infected system
  
• Updates itself

Last update 25 June 2008

 

TOP