Home / malware

PDF

Backdoor:Win32/IRCbot.HK

First posted on 29 October 2014.
Source: Microsoft

Aliases :

There are no other names known for Backdoor:Win32/IRCbot.HK.

Explanation :

Threat behavior

Installation

Backdoor:Win32/IRCbot.HK copies itself to the following locations:

• \\2485764.exe
• \\taskmgr.exe

The malware creates the following files on your PC:

• \\system32.vbs
• c:\documents and settings\administrator\start menu\programs\startup\explorer.ini.url

Payload

Allows backdoor access and control

Backdoor:Win32/IRCbot.HK tries to connect to an IRC server at mail.plasmarat.pw via TCP port 5874. It then joins a channel and waits for commands. A hacker can use this backdoor to perform a number of actions, including:

• Downloading and running files
• Uploading files
• Spreading malware to other PCs
• Logging your keystrokes or stealing your sensitive data
• Modifying your system settings
• Running or stopping applications
• Deleting files

This malware description was produced and published using automated analysis of file SHA1 339c64b2f62f7d1d03887df768fdc117d5ecbda6.Symptoms

System changes

The following could indicate that you have this threat on your PC:

• You have these files:
  
  \\2485764.exe
  \\system32.vbs
  \\taskmgr.exe
  c:\documents and settings\administrator\start menu\programs\startup\explorer.ini.url

Last update 29 October 2014

 

TOP