W32/Sdbot-ZN is a worm and IRC backdoor Trojan for the Windows platform.
W32/Sdbot-ZN runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Sdbot-ZN spreads by copying itself to network shares.
When first run W32/Sdbot-ZN copies itself to <System>\wdfmrg.exe.
The following registry entries are created to run wdfmrg.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows User Mode Driver Manager
wdfmrg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Windows User Mode Driver Manager
wdfmrg.exe
W32/Sdbot-ZN includes functionality to:
- carry out DDoS flooder attacks
- provide a proxy server
- silently download, install and run new software, including updates of its software, 3rd party software and other malicious executables
- uninstall itself