Home / malware Backdoor.Win32.Wisdoor.N
First posted on 01 March 2007.
Source: SecurityHomeAliases :
Backdoor.Win32.Wisdoor.N is also known as Backdoor:W32/Wisdoor.N, Wisdoor.N.
Explanation :
Wisdoor represents a family of backdoors. They allow the remote control of a victim's computer by sending specific commands via IRC channels. Also, these backdoors can steal data and spread to computers vulnerable to exploits.
cription
When the Windoor.N file is started, it copies itself as a file named "windll.exe" to the Windows folder and then creates the following startup key value in the Registry:
- [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"windll" = "%WINDIR%windll.exe"
When the Backdoor is active, it connects to an IRC server, joins a certain channel and acts as a bot there.
The following IRC server and port is used by the Backdoor:
- web.dardana.info:3926
The backdoor joins the following IRC channel:
- #at
A hacker can send commands to the bots to and control infected computers. Several tasks can be performed, including the following:
- Start HTTP server
- Perform ping, SYN, ICMP and UDP flood
- Get system information including information about OS, network and drives
- Download and execute files
- Log keystrokes
- Capture video using webcam
- Send and receive files
- Scan and exploit computers vulnerable to exploits
When spreading, the bot can exploit the following vulnerabilities:
- IIS port 80 using 'Web Server Folder Traversal' Vulnerability (MS00-078)
- MSSQL port 1443, trying to get access using blank SA account password
Last update 01 March 2007