Home Malware Programs Backdoors Backdoor.Win32.mIRC-based.k

Backdoor.Win32.mIRC-based.k

Posted: October 29, 2009

Backdoor.Win32.mIRC-based.k is a backdoor. By using hidden or
undocumented means, BackDoor-DKH gets into a computer system, or software program using such ways to access a computer system. Some software programs have a backdoor set by the evil programmers to enable them to obtain access to troubleshoot or modify the application. Software that is classified as a 'backdoor' is created to exploit a vulnerability in a computer system and open it up to further allow access to a hacker.

Aliases

BackDoor-DKH (McAfee)
Troj/Bckdr-QPX (Sophos)
Backdoor.Win32.mIRC-based (Ikarus)
Win-Trojan/Mirc-based.705312 (AhnLab)
PE_Patch.PECompact (Kaspersky Lab)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %ProgramFiles%\Microsoft Office\WINWORD.EXE
    2 %ProgramFiles%\mIRC\IRC Bot\Anjing_Malingsia.sys
    3 %ProgramFiles%\mIRC\IRC Bot\Asshole.sys
    4 %ProgramFiles%\mIRC\IRC Bot\Channel_Babi.sys
    5 %ProgramFiles%\mIRC\IRC Bot\control.ini
    6 %ProgramFiles%\mIRC\IRC Bot\fuck.sys
    7 %ProgramFiles%\mIRC\IRC Bot\kontol.mrc
    8 %ProgramFiles%\mIRC\IRC Bot\Nama_Anjing.sys
    9 %ProgramFiles%\mIRC\IRC Bot\Nama_Babi.sys
    10 %ProgramFiles%\mIRC\IRC Bot\perampok_budaya.sys
    11 %ProgramFiles%\mIRC\IRC Bot\remote.ini
    12 %ProgramFiles%\mIRC\IRC Bot\services.exe
    13 %ProgramFiles%\mIRC\IRC Bot\Stupid.sys
    14 %ProgramFiles%\mIRC\IRC Bot\svchost.exe
    15 %Programs%\Startup\Adobe Gamma Loader.com

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acha.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AmyMastura.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsz.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\registry.exeHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exeHKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefendHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
Loading...