BKDR_ZAPCHAST.HVN

Posted: May 1, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	6/10
Infected PCs:	18

First Seen:	May 1, 2012
OS(es) Affected:	Windows

BKDR_ZAPCHAST.HVN is a slightly-outdated variant of the DarkComet backdoor Trojan and Remote Administration Tool that's installed by a fake Skype encryption program. While BKDR_ZAPCHAST.HVN isn't the most recent version of the DarkComet RAT, its capabilities still extend to allowing criminals to exercise an unhealthy amount of control over your PC, including stealing keyboard input-based information and circumventing security-related features and software. SpywareRemove.com malware researchers have only found BKDR_ZAPCHAST.HVN to be distributed by BKDR_METEO.HVN from the website [censored]encription.sytes.net, although other versions of the DarkComet Trojan are, of course, at large through a variety of other disease vectors. Preventing a BKDR_ZAPCHAST.HVN infection, therefore, is as simple as avoiding suspicious Skype encryption software – particularly since Skype already includes default AES encryption that's more than adequate for almost any purpose.

How BKDR_ZAPCHAST.HVN Gets Around with a Little Help from Trojan Friends

Although other versions of the DarkComet RAT are distributed in a variety of ways, BKDR_ZAPCHAST.HVN is distinct for being installed by a second Trojan, BKDR_METEO.HVN, which is promoted as a supposed encryption utility for Skype-based voice communications. SpywareRemove.com malware analysts have confirmed, of course, that BKDR_METEO.HVN doesn't have any genuine encryption functions and that installing its software is a complete waste of time that doesn't serve to accomplish anything except infecting your PC with both BKDR_METEO.HVN and BKDR_ZAPCHAST.HVN. This distribution strategy is somewhat newsworthy for being targeted at Syrian rebels, who are noted to use online social networking sites and products like Skype to transmit potentially sensitive tactical information.

Also, noteworthy is the fact that BKDR_ZAPCHAST.HVN is far from the last such-targeted attack; even the server that hosts the fake software that installs BKDR_ZAPCHAST.HVN has been confirmed for its history of engaging in similar attacks against the Syrian rebellion. SpywareRemove.com malware researchers warn that associated dangers, such as phishing attacks for Facebook passwords and other social networking-based forms of aggression, should be considered active and ongoing threats for anyone that's involved in the Syrian conflict.

Why a BKDR_ZAPCHAST.HVN Attack May Be Just as Bad for Your PC is as War is for Syria

BKDR_ZAPCHAST.HVN is only version 3.3 of the DarkComet RAT, a backdoor Trojan that has been developed up to at least version 5.0, but even outdated versions of DarkComet should still be considered extremely serious threats to your computer. Like all backdoor Trojans, BKDR_ZAPCHAST.HVN specializes in avoiding notice while allowing criminals to take over your PC and control it using a remote C&C (Command and Control) Server. Samples of some prominent BKDR_ZAPCHAST.HVN attacks that SpywareRemove.com malware experts warn against taking lightly include:

Enabling remote access to all files on your PC – this includes deleting, copying or editing them.
Attacks to block security and system diagnostic programs such as Task Manager, Windows Firewall or the Registry Editor.
Keylogging functions that record your keyboard input.
Hosts file changes that can redirect your browser to undesirable sites or block your access to safe sites.

BKDR_ZAPCHAST.HVN can also be configured to use various types of stealth and obfuscation techniques, including code injection into normal system processes. SpywareRemove.com malware researchers suggest that you avoid deleting BKDR_ZAPCHAST.HVN by manual methods, since this can inadvertently damage your operating system or other innocent files. However, suitable anti-malware products are all capable of identifying and deleting BKDR_ZAPCHAST.HVN along with BKDR_METEO.HVN.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

skype.exe

File name: skype.exe
Size: 360.71 KB (360719 bytes)
MD5: 09172745ccf3d8e3defdc470452dbe67
Detection count: 17
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 3, 2012

file.exe

File name: file.exe
Size: 1.05 MB (1058659 bytes)
MD5: c0efb93d434be914b635285263ea29e2
Detection count: 16
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 3, 2012