VIRUS NAME : BackDoor-OG
Trojan Characteristics
There are many variants of this remote access trojan. This is due to a configuration tool that is used by an attacker to modify the actions of this trojan. As such, the description shown here is only a guide for the types of actions BackDoor-OG takes.
This IRC bot trojan arrives as an executable file. When run, the trojan may get copied to the WINDOWS SYSTEM directory. A registry key is created to load the trojan at startup. Such as:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\vchost=%Trojan%
Once running, the trojan connects to an Internet Relay Chat server and joins a specified channel. At this point an attacker can send private messages to the bot, which contain instructions to initiate a Denial Of Service attack against another machine on the Internet.
Symptoms
- Port 6667 being unrepentantly accessed..
Method Of Infection
When this trojan is run, it installs itself to load each time Windows starts.
|
