Backdoor.Win32.IRCBot.dig

[Malekal_morte]

Découvert par Laurent (MSNfix)

Ajoute le fichier %windir%\mservice.exe
La clef run et le fichier sont identiques.

Message de propagation :

hey, see, its you hxxp://imaageshack.org/Image0936.JPG
WoW? is that really you... what the hell where you drinking
LOL, you look so ugly in this picture, no joke...
Should I put this on facebook/myspace?
Hey m8, who is this on the right, in this picture...
Sup, seen the pictures from the other night?

Scan du fichier :

Fichier bot.exe reçu le 2008.06.03 09:25:59 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 4/32 (12.5%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.30.1 2008.06.03 -
AntiVir 7.8.0.26 2008.06.03 -
Authentium 5.1.0.4 2008.06.02 -
Avast 4.8.1195.0 2008.06.03 -
AVG 7.5.0.516 2008.06.02 -
BitDefender 7.2 2008.06.03 -
CAT-QuickHeal 9.50 2008.06.02 -
ClamAV 0.92.1 2008.06.02 -
DrWeb 4.44.0.09170 2008.06.03 -
eSafe 7.0.15.0 2008.06.02 -
eTrust-Vet 31.4.5844 2008.06.03 -
Ewido 4.0 2008.06.02 -
F-Prot 4.4.4.56 2008.06.02 -
F-Secure 6.70.13260.0 2008.06.03 Backdoor.Win32.IRCBot.dig
Fortinet 3.14.0.0 2008.06.03 -
GData 2.0.7306.1023 2008.06.03 Backdoor.Win32.IRCBot.dig
Ikarus T3.1.1.26.0 2008.06.03 -
Kaspersky 7.0.0.125 2008.06.03 Backdoor.Win32.IRCBot.dig
McAfee 5308 2008.06.02 -
Microsoft 1.3604 2008.06.03 VirTool:Win32/DelfInject.gen!AC
NOD32v2 3153 2008.06.03 -
Norman 5.80.02 2008.06.02 -
Panda 9.0.0.4 2008.06.02 -
Prevx1 V2 2008.06.03 -
Rising 20.47.10.00 2008.06.03 -
Sophos 4.29.0 2008.06.03 -
Sunbelt 3.0.1143.1 2008.06.03 -
Symantec 10 2008.06.03 -
TheHacker 6.2.92.332 2008.06.03 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.02 -
Webwasher-Gateway 6.6.2 2008.06.03 -
Information additionnelle
File size: 60114 bytes
MD5...: 5e1cae5b38e74143c2564cd7807f1f3f
SHA1..: 9e6c68f80e28212a6977a3bd64ce43044e055695

[Malekal_morte]

Antivir le détecte maintenant en Worm/IRCBot.dig :

The file 'bot.exe' has been determined to be 'MALWARE'. Our analysts named the threat Worm/IRCBot.dig. The term "WORM/" denotes a worm that is able to spread itself for instance over the Internet (using eMail, peer-to-peer networks, IRC networks etc.).Detection will be added to our virus definition file (VDF) with one of the next updates.