BKDR_IRCBOT.NRG

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windongs = "{malware path and file name}"

Other Details

This backdoor connects to the following possibly malicious URL:

• {BLOCKED}n.{BLOCKED}s.cat

NOTES:

This backdoor connects to the following sites to perform a speed test:

• http://speedtest1.{BLOCKED}city.net/speedtest/upload.php?x={random value}
• http://{BLOCKED}.{BLOCKED}.12.242/speedtest/upload.php?x={random number}
• http://{BLOCKED}h-electronics.comuf.com/speedtest/upload.php?x={random number}