Software:Dorkbot (malware)
Dorkbot is a family of malware worms that spreads through instant messaging, USB drives, websites or social media channels like Facebook. It originated in 2015 and infected systems were variously used to send spam, participate in DDoS attacks, or harvest users' credentials.[1]
Functionality
Dorkbot’s backdoor functionality allows a remote attacker to exploit infected systems. According to an analysis by Microsoft and Check Point Research, a remote attacker may be able to:[2][3]
- Download and run a file from a specified URL;
- Collect login information and passwords through form grabbing, FTP, POP3, or Internet Explorer and Firefox cached login details; or
- Block or redirect certain domains and websites (e.g., security sites).
Impact
A system infected with Dorkbot may be used to send spam, participate in DDoS attacks, or harvest users' credentials for online services, including banking services.[2]
Prevalence
Between May and December 2015, the Microsoft Malware Protection Center detected Dorkbot on an average of 100,000 infected machines each month.[4]
History
On December 7, 2015, the FBI and Microsoft in a joint task force took down the Dorkbot Botnet.[5]
Remediation
In 2015, the U.S. Department of Homeland Security advised the following action to remediate Dorkbot infections:[2]
- Use and maintain anti-virus software
- Change your passwords
- Keep your operating system and application software up-to-date
- Use anti-malware tools
- Disable AutoRun
See also
- Alert (TA15-337A)
- Code Shikara (Computer worm)
- Computer worm
- HackTool.Win32.HackAV
- Malware
- US-CERT
References
- ↑ "Worm:W32/Dorkbot.A Description | F-Secure Labs" (in en). https://www.f-secure.com/v-descs/worm_w32_dorkbot_a.shtml.
- ↑ 2.0 2.1 2.2 "TA15-337A: Dorkbot". National Cyber Awareness System:, U.S. Department of Homeland Security. December 3, 2015. https://www.us-cert.gov/ncas/alerts/TA15-337A.
- ↑ "dorkbot-an-investigation: Dorkbot". Check Point Research. February 4, 2018. https://research.checkpoint.com/dorkbot-an-investigation/.
- ↑ "Microsoft assists law enforcement to help disrupt Dorkbot botnets". Microsoft Malware Protection Center. December 3, 2015. http://blogs.technet.com/b/mmpc/archive/2015/12/03/microsoft-assists-law-enforcement-to-help-disrupt-dorkbot-botnets.aspx.
- ↑ "FBI, Microsoft and Computer Emergency Response Team Polska Takes Down Global DorkBot Malware Botnet". Geek Inspector. December 7, 2015. http://geekinspector.com/2943/news/fbi-and-microsoft-takes-down-global-dorkbot-malware-botnet.
 |  |
