BackDoor.IRC.Aryan.1
Posted: May 21, 2012
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Threat Level: | 6/10 |
|---|---|
| Infected PCs: | 65 |
| First Seen: | May 21, 2012 |
|---|---|
| OS(es) Affected: | Windows |
BackDoor.IRC.Aryan.1 is a recent malware arrival from Russia. As a backdoor Trojan and IRC bot with limited worm-like reproduction capabilities, BackDoor.IRC.Aryan.1 can compromise your PC to force it into a DDoS-causing botnet, download other malicious files and install them on your hard drive, spread via removable drives and even replace files on your removable drives with shortcuts to launch itself. Other than indirect symptoms that are observable due to its shortcut attacks and other security violations, BackDoor.IRC.Aryan.1 doesn't show plain symptoms, and SpywareRemove.com malware experts consider an analysis with a good anti-malware program the best way to find and remove BackDoor.IRC.Aryan.1 with a minimum of trouble. Since BackDoor.IRC.Aryan.1 injects its code into normal system processes by default, attempting to get rid of BackDoor.IRC.Aryan.1 without appropriate assistance risks causing harm to Windows (the only operating system that BackDoor.IRC.Aryan.1 is designed to attack).
BackDoor.IRC.Aryan.1 – the Worm-like Bot That Slips in Through USB Ports
SpywareRemove.com malware researchers have rated BackDoor.IRC.Aryan.1's payload as being sufficiently generally-applicable to be useful for various types of attacks against PCs, but as an IRC bot, BackDoor.IRC.Aryan.1's main purpose is to use your computer resources to launch remote attacks. DDoS attacks and similar types of botnet-based crimes can occur without symptoms (other than, obviously, the necessary system resource expenditures, such as RAM or CPU usage), and BackDoor.IRC.Aryan.1 specifically has been found to inject code into the Windows process 'explorer.exe' to hide its existence. Even if this injection attack fails, BackDoor.IRC.Aryan.1 is built with a backup plan that creates a new thread as a last resort to achieve functionality.
Even though BackDoor.IRC.Aryan.1 isn't classified as a worm, BackDoor.IRC.Aryan.1's designated distribution method is through the classic worm strategy of copying itself to removable drive devices. With the addition of a hidden Autorun.inf file, BackDoor.IRC.Aryan.1 can install itself on any PC that shares a device with an infected computer. SpywareRemove.com malware researchers also found a secondary reproduction technique for BackDoor.IRC.Aryan.1, which also exploits removable media devices by replacing normal files with shortcuts. These shortcuts are designed to launch both BackDoor.IRC.Aryan.1 and files that were replaced by the shortcuts, which allows BackDoor.IRC.Aryan.1to launch manually and without suspicion.
Notably, these attacks eschew targeting the A and B drives. If BackDoor.IRC.Aryan.1 is launched from a removable drive, BackDoor.IRC.Aryan.1 will also try to close the process cmd.exe (a process that's critical to the Windows operating system).
Shredding BackDoor.IRC.Aryan.1's Botnet Web
Besides using an extra layer of redundancy to launch itself and to reproduce, BackDoor.IRC.Aryan.1 has also been found to have self-preserving functions that prevent PC users from just deleting BackDoor.IRC.Aryan.1 even if they can locate all of its files. BackDoor.IRC.Aryan.1 will constantly check the hard drive for its files and, if necessary, reinstall itself onto the relevant HD automatically. Along with all this, SpywareRemove.com malware experts also warn that any particular BackDoor.IRC.Aryan.1 infection may also complicate matters by installing other types of PC threats that are downloaded from C&C servers.
Since BackDoor.IRC.Aryan.1 uses relatively advanced attacks with multiple levels of fail safes, SpywareRemove.com malware researchers suggest finding and deleting BackDoor.IRC.Aryan.1 only once you can use competent anti-malware software for the process. Until then, you should avoid sharing removable drive devices with other computers, as that will almost certainly allow BackDoor.IRC.Aryan.1 to distribute itself to new PCs.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:file.exe
File name: file.exeSize: 39.42 KB (39424 bytes)
MD5: 59818a8149e2d4879f17c474bf5f57ab
Detection count: 70
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 28, 2012
load.exe
File name: load.exeSize: 39.42 KB (39424 bytes)
MD5: 0ec4e9986a3a90a86429b845451dc2d8
Detection count: 69
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 28, 2012
file.exe
File name: file.exeSize: 39.42 KB (39424 bytes)
MD5: c93c9e247a992aae78bccddaad5ecc51
Detection count: 68
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 28, 2012
file.exe
File name: file.exeSize: 39.42 KB (39424 bytes)
MD5: 7cf76c936ddb5468059927ad3297ddff
Detection count: 67
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 28, 2012
file.exe
File name: file.exeSize: 39.42 KB (39424 bytes)
MD5: 920e45199d7a8b165f408ba4646c6dc6
Detection count: 65
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 28, 2012
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.