Helps to Disrupt “Dorkbot” – Major Botnet Malware

By   ISBuzz Team
Writer , Information Security Buzz | Dec 09, 2015 08:00 pm PST

ESET took part in a global operation to uncover malware affecting more than a million computers.

The operation by law enforcement agencies around the globe led by the FBI, Interpol and Europol disrupted the Dorkbot infrastructure, including Command and Control servers in Asia, Europe, and North America. What’s more, the operation has led to the seizure of domains, thus disrupting the botnet operators’ capacity to control their victims’ computers. Jean-Ian Boutin, malware researcher at ESET have the following comments on it.

[su_note note_color=”#ffffcc” text_color=”#00000″]Jean-Ian Boutin, Malware Researcher at ESET :

“To make the internet safer and protect our users, we have contributed to the disruption efforts. In the case of Dorkbot, ESET shared technical analyses and statistical information about the malware and provided the domains and internet addresses of the botnet’s command and control servers,”.

Dorkbot is a well-established botnet  based on Win32/Dorkbot malware that is distributed via various channels, such as social networks, spam, removable media and exploit kits. Once installed on the machine, it will try to disrupt the normal operation of security software by blocking access to its update servers and will then connect to an IRC server to receive further commands.

Besides being a password stealer targeting popular services such as Facebook and Twitter, Dorkbot typically installs code from one of several other malware families soon after it gains control of a given system. Notably, Win32/Kasidet, malware used to conduct DDoS attacks also known as Neutrino bot, and Win32/Lethic, a well-known spambot, are regularly dropped by Dorkbot onto compromised systems.

“As we’ve seen thousands of detections every week coming from almost all parts of the world and there are fresh samples arriving daily, Dorkbot seemed like a viable target for a disruption effort,”.

ESET products currently protect their users against thousands of variations of Dorkbot modules, along with many other forms of malware distributed by the Dorkbot botnets. Internet users who believe that their system might be infected by Dorkbot can make use of ESET’s free tool to run a thorough scan.[/su_note]

[su_box title=”About ESET” style=”noise” box_color=”#336588″]ESETSince 1987, ESET® has been developing award-winning security software that now helps over 100 million users to Enjoy Safer Technology. Its broad security product portfolio covers all popular platforms and provides businesses and consumers around the world with the perfect balance of performance and proactive protection. The company has a global sales network covering 180 countries, and regional offices in Bratislava, San Diego, Singapore and Buenos Aires.[/su_box]

Notify of
3 Expert Comments
Oldest Most Voted
Inline Feedbacks
View all comments

Recent Posts

Would love your thoughts, please comment.x