Trojan.Linux.MIRAI.E

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Andere Details

It connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.8:53
• {BLOCKED}.{BLOCKED}.{BLOCKED}.199:1312
• {BLOCKED}.{BLOCKED}.{BLOCKED}.63:7777

Es macht Folgendes:

• It creates a TCP socket and listens for incoming connections by binding it to the following loopback address:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.1:46237
• It creates and sets the name of its child processes using the following:
  • /bin/sh
• It deletes itself after spawning its child processes.
• It checks for the following files related to watchdog to disable its functions if found:
  • /bin/watchdog
  • /dev/FTWDT101_watchdog
  • /dev/FTWDT101/watchdog
  • /dev/watchdog0
  • /etc/default/watchdog
  • /etc/watchdog
• It restarts the system after all the child processes terminates.