BDS/Arg - Backdoor Server

See also

Full description

Alias:	Backdoor.VNC-based, BackDoor-ARG
Type:	Worm
Size:	212.992 Bytes
Origin:
Date:	00-00-0000
Damage:	BDS/Arg gives a third party unauthorized access to an infecetd computer.
VDF Version:	6.23.00.00
Danger:	Low
Distribution:	Low

Technical DetailsThe Trojan secures VNC applications, after it names itself EXPLORER.EXE. It performs the installation of the file INST.EXE, which is used by the VNC application. The Trojan listens on TCP Port 5800 waiting for further commands.
It creates the following hidden files, in %Font% directory:

VNCHooks.dll (32,768 Bytes)
explorer.exe (212,992 Bytes)
omnithread_rt.dll

The Trojan will be installed by a so-called Dropper. It makes the following Registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "Explorer" = %Fonts folder%\explorer.exe

When active, the Trojan connects itself to the following IRC Servers:

cocket.nailed.org
cocket.mooo.com
cocket.bounceme.net
cocket.phathookups.com
cocket.gotdns.com
cocket.ma.cx
cocket.orgdns.org
cocket.minidns.net
cocket.dyn.nicolas.cx
cocket.dynup.net
cocket.pokemonfan.org
cocket.staticcling.org
cocket.getmyip.com

It can send an email, to inform the attacker about the System infection.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back