Signature Detail

WORM: Akak Backdoor Activity

This signature detects Akak worm traffic over port 4321. The Akak worm typically infects targets by exploiting an Internet Explorer JavaScript vulnerability. After a target is infected, Akak enables malicious users to remotely control a Windows host.

Extended Description

Worm Akak is a backdoor program that creates a SOCKS proxy on a compromised system. It allows a remote attacker to download and execute files on the compromised computer.

References

• URL: http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?idvirus=51672
• URL: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.akak.html
• URL: http://www.lurhq.com/akak.html