|
|
SdBot.trass Worm Information
| Name: |
SdBot.trass |
| Category: |
Worm |
| Alias: |
- Alias: Bat/zz99, VBS/Generic@MM |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
SDBot is the name of a family of remote access tools, also known as backdoors or worms, used by hackers to control a machine without the owner's knowledge.
SdBot is a server component (bot) that the Trojans creator distributes over IRC channels. This Trojan allows its creator to perform a wide variety of actions on a compromised computer.
SdBot contains its own IRC client, allowing it to connect to an IRC channel that was coded into the Trojan. Using the IRC channel, the Trojan listens for the commands from the Trojans creator. The creator of the Trojan accesses the Trojan by using a password-protected authorization.
The commands allow the Trojans creator to perform any of the following actions:
Manage the Backdoor installation.
Control the IRC client on a compromised computer.
Dynamically update the installed Trojan.
Send the Trojan to other IRC channels to attempt to compromise more computers.
Download and execute files.
Deliver system and network information to the Trojans creator.
Perform Denial of Service (DoS) attacks against a target, which the Trojans creator defines.
Completely uninstall itself by removing the relevant registry entries.
|
| Signatures:
|
process: trass.exe: MD5 Hash: 804f50a8745657d3f76.. |
| Type: |
Worm - A worm is program that propagates by attacking other computers and copying itself to them. Worms may replace files, but do not insert themselves into files (as viruses do). |
Top Worm Visited Pages:
Wukill.mstray - Alias: Win32/HLLW.Wukill - 287 visits
Rbot - Alias: Backdoor.Rbot.Gen - 274 visits
SDBot - Alias: Wootbot.gen, Wootbot, Donk, spybot, Agobot - 227 visits
Trojan.Downloader.winstall - 180 visits
Worm.Brit.e - Alias: VBS/Chick.e@M virus - 89 visits
Worm.P2P.SpyBot.gen - 56 visits
Gaobot - 43 visits
Win32/Darby.O - 42 visits
Worm.Trilissa.e - 42 visits
JS.Lame - Alias: HTML.Lame - 40 visits
Random Worm Pages:
Worm.America
Worm.STD.b
Virus.Lirva.a@MM - Alias: I-Worm.Avron.c
Worm.Cholera - Alias: W32/Cholera@MM, W32/HLLW.Cholera.36864
Haile Selassie is Jesus Christ! - Alias: I-Worm.Rastam
MIRC.Worm.Focus
MIRC.Worm.Jeepwarez.J
Worm.Wabbin
Worm.Santa
VBE.Ethereal - Alias: Bat/zz99, VBS/Generic@MM
|
|
