ELF_KAITEN.SME

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit IRC-Servern (Internet Relay Chat). Wählt sich in einen IRC-Kanal ein.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Verbindet sich mit einem oder mehreren der folgenden IRC-Server:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.23:443

Wählt sich in einen oder mehrere der folgenden IRC-Kanäle ein:

• #roots

Andere Details

Es macht Folgendes:

• It adds the line "/" to either of the following startup scripts to enable its automatic execution at every system startup:
  • /etc/rc.d/rc.local
  • /etc/rc.conf
• It disguises itself as a legitimate process by executing using the following process names:
  • master
  • crond
  • -bash
• It accesses the following file to generate random strings:
  • /usr/dict/words