|
|
Rbot.wrauclt Worm Information
| Name: |
Rbot.wrauclt |
| Category: |
Worm |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
Rbot is the name of a family of remote access tools, also known as backdoors or worms, used by hackers to control a machine without the owner's knowledge.
Rbot.wrauclt is a network worm and IRC backdoor Trojan for the Windows platform. Rbot.wrauclt spreads using a variety of techniques including exploiting weak passwords on computers and SQL servers, exploiting operating system vulnerabilities (including DCOM-RPC, LSASS, WebDAV and UPNP) and using backdoors opened by other worms or Trojans.
Rbot.wrauclt can be controlled by a remote attacker over IRC channels. The backdoor component of Rbot.wrauclt can be instructed by a remote user to perform the following functions:
start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
|
| Signatures:
|
process: wuaruclt.exe: MD5 Hash: e0062f65ef59958e525...
process: wuaucrlt.exe: MD5 Hash: baefda028c3c6a9ea6c...
process: wuaurlt.exe: MD5 Hash: 08bf404a98fd9a710ed...
process: wrauclt.exe: MD5 Hash: b2ace503a8c1ec17b3e...
process: wuaurlt.exe: MD5 Hash: a7ca1ddc388d49e4d4f...
process: wruaclt.exe: MD5 Hash: 9cf623b80d29ad31be7...
process: wuacrlt.exe: MD5 Hash: f47452203605691298c...
process: wuanclt.exe: MD5 Hash: e1af5d05e020a027e6d...
process: wuanclt.exe: MD5 Hash: dc511952891af81aa44.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 288 visits
Rbot - Alias: Backdoor.Rbot.Gen - 275 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 228 visits
Trojan.Downloader.winstall - 181 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 89 visits
Worm.P2P.SpyBot.gen - 56 visits
Gaobot - 43 visits
Win32/Darby.O - 42 visits
Worm.Trilissa.e - 42 visits
JS.Lame - Alias: HTML.Lame - 40 visits
Random Worm Pages:
Worm.Satan
Mitglieder - Alias: TrojanProxy.Win32.Mitglieder.c [F-secure], Trojan.Mitglieder [Norton]
Worm.NewApt.d
IRC.Worm.Cybesh
PIF Worm Remover - Alias: VTool/pwr
Worm.P2P.Adil
Worm.Maldal.h
Worm.Swen
MIRC.Worm.Fono
IRC.Worm.Becky
|
|
