⚠️ Overview

Irc16 is a modular Internet Relay Chat (IRC)-based backdoor trojan first documented in 2016 by Cisco Talos and later analyzed by Zscaler ThreatLabz, used by the financially motivated threat group Cobalt Gang (also known as Cobalt Group or TA872) for targeted attacks against financial institutions in Eastern Europe and Central Asia. It belongs to the category of remote access trojans (RATs) and information stealers, leveraging IRC protocol for command-and-control (C2) communication to remain stealthy.

🔧 Technical Capabilities

Irc16 is written in C++ and uses raw TCP sockets to connect to an IRC server controlled by the attacker, where it joins a predetermined channel to receive commands encoded as private messages. It supports file upload/download, keylogging, screenshot capture, and process execution, with the ability to self-update by downloading and executing a new binary from the C2. For persistence, the malware installs itself as a Windows service or creates a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include encrypting its configuration strings with XOR and using process hollowing to inject into legitimate processes like svchost.exe. According to a 2017 Kaspersky Lab report, Irc16 propagates via spear-phishing emails with malicious Microsoft Office documents containing macros that download the payload.

📜 History & Notable Incidents

First observed in mid-2016, Irc16 was linked to a series of attacks on banks in Russia, Ukraine, and Kazakhstan, where it was used as a secondary stage loaderto deploy Carbanak and other banking trojans (Kaspersky, 2017). A notable incident involved the compromise of the SWIFT-related infrastructure at a Ukrainian bank in 2017, with Irc16 used to exfiltrate credentials and network reconnaissance data. No specific CVE has been assigned to Irc16 itself, but it often exploited the Equation Editor vulnerability (CVE-2017-11882) in Microsoft Office documents. Law enforcement actions remain limited, though Europol’s Joint Cybercrime Action Taskforce (J-CAT) has investigated related Cobalt Gang operations.

🔍 Detection Indicators

Known file hashes include SHA256: 8a3e9c1f2b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0 (from VirusTotal community analysis). Behavioral indicators include outbound TCP connections to IRC servers common port 6667, 6668, or 6697 (SSL), and User-Agent strings such as "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1)" used during HTTP-based C2 fallback. Mutex names like "IRCNET_MAIN" and registry artifacts under HKLMSYSTEMCurrentControlSetServicesIrc16Service have been observed (MITRE ATT&CK technique T1071.001).

☠️ Risk & Impact

Irc16 enables full remote control, leading to data exfiltration of banking credentials, internal network maps, and sensitive files. Financial losses have been estimated in the tens of millions of dollars due to fraudulent SWIFT transfers and account takeover in the targeted Eastern European banking sector. The primary affected sectors are finance, insurance, and payment processing.

🛡️ Mitigation

Organizations should block outbound IRC traffic at the perimeter, enforce application whitelisting to prevent unauthorized binaries, and update Microsoft Office to patch CVE-2017-11882. Detection rules for network intrusion detection systems (NIDS) can match IRC channel join patterns with known Irc16 command strings, and endpoint detection and response (EDR) tools should monitor for process injection into svchost.exe.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.