Home / malwarePDF  

Backdoor:Win32/IRCbot.CK


First posted on 13 February 2009.
Source: SecurityHome

Aliases :

Backdoor:Win32/IRCbot.CK is also known as Also Known As:W32.IRCBot (Symantec).

Explanation :

Backdoor:Win32/IRCbot.CK is a backdoor trojan that is capable of connecting to an IRC server and executing commands from a remote attacker. It may also have spreading capabilities.

Symptoms
System ChangesThe following system changes may indicate the presence of this malware:

  • The presence of the following files:
    <system folder>system.exe - this is a hidden file so you may first have to configure your system to display hidden files
  • The presence of the following registry modifications:
    Added value: "Content Type"
    With data: "text/x-component"
    To subkey: HKCR.htc

    Added value: "NvCplDaemon"
    With data: "<system folder>system.exe"
    To subkey: HKLMSoftwareMicrosoftWindowsCurrentVersionRun


    • Backdoor:Win32/IRCbot.CK is a backdoor trojan that is capable of connecting to an IRC server and executing commands from a remote attacker. It may also have spreading capabilities.

    Installation
    Backdoor:Win32/IRCbot.CK creates the following files in the system:
  • <system folder>system.exe - copy of itself as a hidden file
  • <system folder><3 digit number>.exe - another copy of itself
  • %temp%<5 digit number>.sys - a rootkit driver, detected as VirTool:WinNT/Rootkitdrv.GH
    • Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:WinntSystem32; and for XP and Vista is C:WindowsSystem32. It creates the mutex "NvCplDaemon" and the following registry entry: Adds value: "Content Type"
    With data: "text/x-component"
    To subkey: HKCR.htc It also creates the following registry entry to enable its copy to run every time Windows starts: Modifies value: ""From data: "<system folder>userinit.exe"
    With data: "<system folder>userinit.exe,<system folder>system.exe"
    To subkey: HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon Adds value: "NvCplDaemon"
    With data: "<system folder>system.exe"
    To subkey: HKLMSoftwareMicrosoftWindowsCurrentVersionRun If any of the above autorun registry entries are modified or deleted, Win32/IRCbot.CK recreates them. It also monitors the following registry key to check if its copies are pending for renaming:
    HKLMSYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations If an entry exists for any of its copies, that entry is removed to prevent them from being renamed. Win32/IRCbot.CK also injects malware code into "explorer.exe".Spreads Via...Removable DrivesWin32/IRCbot.CK may spread to other systems via removable drives. If a removable drive, such as a flash drive or a portable hard disk, is present in the system, Win32/IRCbot.CK drops the following files in it:
  • explorer.exe - copy of itself
  • autorun.inf - INF file that enables the backdoor copy to automatically run every time the drive is accessed and Autorun is enabled
    • MS08-067Win32/IRCbot.CK may spread to other systems that are unpatched against the vulnerability discussed in Microsoft Security Bulletin MS08-067. It creates a thread that scans for possible exploitable machines and, if found, copies itself in the system. Yahoo! MessengerWin32/IRCbot.CK may spread via Yahoo! Messenger. If Yahoo! Messenger is currently active in the system, it spreads by sending a copy of itself to all of the user's contacts.

    Payload
    Bypasses FirewallWin32/IRCbot.CK bypasses the system firewall by adding itself to the firewall exception list: Adds value: ""
    With data: "<system folder>system.exe:*:Enabled:NvCplDaemon"
    To subkey: HKLMSYSTEMControlSet001ServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList Modifies System DateWin32/IRCbot.CK modifies the system date to January 1, 2090. Backdoor FunctionalityWin32/IRCbot.CK attempts to connect to the IRC server "sex.pornoturkiye.com" via TCP port 81. Once connected, an attacker can instruct this backdoor to download and execute files, scan for other systems, perform Denial of Service attacks, and attempt to access systems vulnerable to certain exploits. Blocks MSN CommunicationWin32/IRCbot.CK checks if MSN Messenger is active in the system. If it is, it blocks all communication between the user and the user's contacts.

    Analysis by Scott Molenkamp and Patrik Vicol

    Last update 13 February 2009

     

    TOP

    Malware :

    Family: