Analisado por: Christopher Daniel So   
 Plataforma:

Linux, UNIX, Mac OS X

 Classificao do risco total:
 Potencial de dano:
 Potencial de distribuição:
 infecção relatada:
 Exposição das informações:
Baixo
Medium
Alto
Crítico

  • Tipo de grayware:
    Backdoor

  • Destrutivo:
    Não

  • Criptografado:
    Não

  • In the Wild:
    Sim

  Visão geral

Canal de infecção: Aus dem Internet heruntergeladen, Fallen gelassen von anderer Malware

Verbindet sich mit IRC-Servern (Internet Relay Chat). Wählt sich in einen IRC-Kanal ein. Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

  Detalhes técnicos

Tipo de compactação: 216,166 bytes
Tipo de arquivo: Script
Residente na memória: Sim
Data de recebimento das amostras iniciais: 29 setembro 2014
Carga útil: Compromises system security, Connects to URLs/IPs

Backdoor-Routine

Verbindet sich mit einem oder mehreren der folgenden IRC-Server:

  • {BLOCKED}.{BLOCKED}.240.38:1337

Wählt sich in einen oder mehrere der folgenden IRC-Kanäle ein:

  • #xrt

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

  • !die - Terminate current process
  • !killall - Terminate all Perl processes
  • !reset - Reconnect to IRC server
  • !jo - Join a channel
  • !part - Leave a channel
  • !nick - Change nickname
  • !pid - Send fake process name and process ID
  • ! - Execute a shell command
  • !raw - Send raw IRC message
  • !say - Send private message
  • !act - Send an action command
  • !timot - Set timeout value used in performing HTTP GET
  • !matek - Terminate current process
  • !modarkabeh - Terminate all Perl processes
  • !reset - Reconnect to IRC server
  • !jo - Join a channel
  • !part - Leave a channel
  • .sh - Execute a shell command
  • {current nickname} - Execute a shell command
  • !Goox - Enable or disable usage of Google search engines
  • !engine - Enable or disable usage of non Google search engines
  • !pid - Send fake process name and process ID
  • !cari - Search for websites with accessible Magento database configuration file
  • !jnews - Search for websites that uses vulnerable jNews extensions
  • !jnews2 - Search for websites that uses vulnerable jNews extensions
  • !open - Search for websites using vulnerable OpenEMR
  • !civ - Search for websites using vulnerable CiviCRM
  • !civic - Search for websites using vulnerable CiviCRM
  • !letter - Search for websites that uses vulnerable jNews extensions
  • !letter2 - Search for websites that uses vulnerable jNews extensions
  • !tum - Search for websites using PBV MULTI VirtueMart theme with vulnerable TimThumb
  • !piwik - Search for websites using vulnerable Piwik
  • !slim - Search for websites using vulnerable Slimstat Ex
  • !seo - Search for websites using vulnerable SEO Watcher
  • !sql - Search for websites vulnerable to SQL injection
  • !civicrm - Search for websites using vulnerable CiviCRM
  • !acymailing - Search for websites using vulnerable AcyMailing
  • !acymailing2 - Search for websites using vulnerable AcyMailing
  • !jinc - Search for websites using vulnerable JINC
  • !jinc2 - Search for websites using vulnerable JINC
  • !maianmedia - Search for websites using vulnerable Maian Media
  • !maianmedia2 - Search for websites using vulnerable Maian Media
  • !joomleague - Search for websites using vulnerable JoomLeague
  • !joomleague2 - Search for websites using vulnerable JoomLeague
  • !woopra - Search for websites using vulnerable Woopra
  • !jce - Search for websites using vulnerable JCE
  • !gento - Search for websites using vulnerable Magento API
  • !zimbra - Search for websites using vulnerable Zimbra
  • !zim - Search for websites using vulnerable Zimbra
  • !shock - Search for websites with CVE-2014-6271 vulnerability and download and execute http://{BLOCKED}x.com/shock/cgi in the vulnerable sites
  • !wplfd - Search for websites vulnerable to directory traversal attacks

  Solução

Mecanismo de varredura mínima: 9.700
Primeiro arquivo padrão VSAPI: 11.180.03
Data do lançamento do primeiro padrão VSAPI: 29 setembro 2014

Führen Sie den Neustart im normalen Modus durch, und durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt nach Dateien, die als PERL_SHELLBOT.DI entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participe da nossa pesquisa!