Home / malwarePDF  

Spybot.HS


First posted on 01 March 2007.
Source: SecurityHome

Aliases :

Spybot.HS is also known as TR/Agent.AEU.1, Trojan.Agent.AEU, W32/Spybot.worm.gen, Backdoor.Win32.SdBot.bcw, W32.Spybot.Worm.

Explanation :

Spybot.HS, a variant of Spybot, is a Trojan. Spybot.HS uses IRC networks to spread and has automatic updating capabilities. Spybot.HS steals certain information from an infected computer.

Spybot.HS allows control of a victims' computer remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to the local network, and to computers vulnerable to exploits.

It drops the following file upon execution:


It will then pass the control over to the dropped file and delete itself after execution.

Spybot.HS also checks for the existence of the following mutex to ensure that there is only one instance of itself running in memory:


Spybot.HS adds these registry value launch points:


It also adds the following registry entry as part of its installation routine:


It also creates the following registry entry to allow itself to bypass the Windows Firewall:


Spybot.HS also connects to the following IRC server:


It then joins the following IRC channel:


Once connected, Spybot.HS awaits for commands from a remote user. It may perform the following backdoor operations:


This backdoor may spread through local networks by taking advantage of the following vulnerabilities:


Spybot.HS is packed with ASProtect 2.1 and ASPack 2.12

Last update 01 March 2007

 

TOP

Malware :

Family: