ELF_KAITEN.SM

This backdoor may be downloaded by other malware/grayware from remote sites.

It joins an Internet Relay Chat (IRC) channel. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor may be downloaded by the following malware/grayware from remote sites:

• TROJ_BASHLITE.A

It may be downloaded from the following remote sites:

• http://www.{BLOCKED}er-services.name/b.c

Backdoor Routine

This backdoor connects to any of the following IRC server(s):

• x.{BLOCKED}shellz.net:25

It joins any of the following Internet Relay Chat (IRC) channels:

• #int
• #pwn

It executes the following commands from a remote malicious user:

• Perform PUSH-ACK flood
• Perform SYN flood
• Perform UDP flood with spoofed source address
• Perform UDP flood without spoofed source address
• Change nickname
• Change server
• Get spoofed source addresses
• Set spoofed address subnet mask
• Disable client
• Enable client
• Terminate client
• Download file
• Stop all attacks
• Send raw IRC command
• Start remote shell

NOTES:

It changes its process name to -bash and clears its command line.

The IRC nickname it uses is a randomly generated string.

It creates and locks the file /tmp/.z to ensure that only one copy of itself is running.