BKDR_IRCBOT.DAM

This malware arrives as a Gadhafi death video spam purporting to come from CNN. When executed, this backdoor sends specific information to the remote server.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor downloads an updated copy of itself from a certain website.

This backdoor executes then deletes itself afterward.

Arrival Details

This backdoor may be downloaded from the following remote sites:

• http://www.{BLOCKED}tinoamerica.com/Gadhafi/video.php
• http://{BLOCKED}8.{BLOCKED}5.238.133/system/FUD.exe

Installation

This backdoor executes then deletes itself afterward.

It injects threads into the following normal process(es):

• EXPLORER.EXE

Backdoor Routine

This backdoor opens the following port(s) where it listens for remote commands:

• TCP 1685

It connects to any of the following IRC server(s):

• {BLOCKED}ro.ru

It joins any of the following IRC channel(s):

• #infe

Other Details

This backdoor connects to the following URL(s) to get the affected system's IP address:

• http://api.wipmania.com/

NOTES:
Once this backdoor successfully connects to the IRC server, the remote malicious user then issues a command to download an updated copy of the malware. During the analysis, the server returns the following URL to download a copy of this malware:

• http://{BLOCKED}8.{BLOCKED}5.238.133/system/FUD.exe

It saves the files it downloads using the following name:

• %Application Data%\C.exe

Once it successfully downloads the file, this backdoor sends the following information to the remote server:

• Download URL
• File size of the downloaded file
• Executed file
• Number of download retries

It may also execute the following commands from a remote malicious user:

• Reset connection
• Terminates the connection

This malware contain errors in its code that prevent this backdoor from properly executing its routines, its file structure is severely damaged, and the starting entry of the files point to the wrong address.