BackDoor-DKV
From Wikipedia, the free encyclopedia
BackDoor-DKV is a Virus that was discovered Friday, February 09, 2007. It is a Trojan type virus with a subtype of Remote Access.
Contents |
[edit] Overview
The BackDoor-DKV trojan has a number of threat vectors such as connecting to IRC, downloading more malware from a remote site and it creates an open backpoor on the local computer. It's aliases are Backdoor.Ircbot.H (BitDefender) Backdoor.Win32.IRCBot.yc (Kaspersky) Bkdr_Rinbot.B (Trend) W32/Trojan.XUU (F-prot).
[edit] Symptoms
The symptoms are known and are the following: When the BackDoor is executed, it drops the following file:
%system%\dydhcp.exe (A copy of itself)In an attempt to make the dropped files harder to find, the files may have their attributes changed to hidden and system.
Note: %System% is a variable location and refers to the windows system directory.
The following registry entry is modified so the BackDoor can run at system startup:
Hkey_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run Dynamic DHCP = "%System%\dydhcp.exe"Once running, the BackDoor component connects to a predefined IRC server on port 4783 and joins a predefined channel by issuing the JOIN command.
At the time of writing this VIL, the author had set the Topic for the channel as a URL for an malicious executable. This in turn is interpreted as a command by the BackDoor and is downloaded and executed on the victim's machine.
The files downloaded from this URL is detected as W32/SpotFace.worm. (Analysis is currently underway for this worm.)
[edit] Characteristics
This is an IRC controlled backdoor, which provides an attacker with unauthorized remote access to the compromised machine and the attacker can perform the following actions on this infected machine:
Retrieve system information Connect to download files from the URLs. Execute programs remotely Start and stop services Perform DDOS Uninstall the botThe characteristics of this BackDoor with regards to the file names, port number used, etc will differ, depending on the way in which the attacker had configured it. Hence, this is a general description.
--Updated Feb. 9, 2007--
BackDoor-CWA.dr has been deemed Low-Profiled due to media attention at http://www.taipeitimes.com/News/taiwan/archives/2007/02/09/2003348274--
[edit] Methods of Infecton
•This BackDoor doesn’t self-replicate. It spreads manually, often under the premise that the executable is something beneficial
•It may also be received as a result of poor security practices, or un-patched machines and vulnerable systems
•Distribution channels include IRC, peer-to-peer networks, email, newsgroups postings, etc
