Home / malware Backdoor:W32/Zapchast
First posted on 10 September 2008.
Source: SecurityHomeAliases :
There are no other names known for Backdoor:W32/Zapchast.
Explanation :
A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.
right]Backdoor:W32/Zapchast variants use an mIRC-client to create a backdoor that gives an attacker access to, and control over, the infected system.
By itself, the mIRC-client is not malicious. Zapchast-variants can however use malicious configuration files to turn the mIRC-client into a backdoor. In addition to subvertiing the mIRC-client, these files wil also contain the name of an IRC-channel which the mIRC-client will automatically try to join on each startup.
The mIRC-client itself is detected as the riskware Client-IRC.Win32.mIRC, while the malicious configuration files are detected as Backdoor.IRC.Zapchast. Sometimes, Zapchast-backdoors will use additional batch-files which provide added functionality, such as performing registry changes to create a launchpoint for the backdoor. These auxiliary batch-files are detected as Trojan.BAT.Zapchast.
The mIRC-client and the necessary files (not all of them may be malicious) are usually dropped somewhere on the hard drive. A registry entry is then created, which starts the mIRC-client every time the computer is started. The mIRC-client, which now functions as a backdoor, then joins the predefined IRC-channel. Using this channel, the attacker can then issue commands to the backdoor and effectively control the infected system.
The mIRC scripting language used to create the malicious configuration files enables the backdoor to do numerous tasks, such as downloading files, acting as a proxy or stealing information by logging keystrokes. The actual functionality of the backdoor depends on the variant in question.Last update 10 September 2008
