TrojanSpy.SH.HADGLIDER.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Puede haberlo descargado otro malware/grayware/spyware desde sitios remotos.

Este malware se elimina tras la ejecución.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Puede haberlo descargado el siguiente malware/grayware/spyware desde sitios remotos:

• Trojan.SH.HADGLIDER.A

Instalación

Infiltra los archivos siguientes:

• /usr/bin/.rksu_sysi.lock → infection marker
• /tmp/.rksu_sysi.lock → infection marker

Robo de información

Recopila los siguientes datos:

• Download Speed
• Uptime
• SSH Port
• RAM Information
• CPU Architecture
• Processor Architecture
• Number of Processors
• Linux Distribution
• User Name
• Host Name

Otros detalles

Hace lo siguiente:

• It terminates itself if any of the following files exist:
  • /usr/share/.workingS
  • /usr/share/.sysinfo
  • /usr/bin/.rksu_sysi.lock
  • /tmp/.rksu_sysi.lock
• It connects to the following URL to get the infected machine's download speed:
  • http://ipv4.download.{BLOCKED}band.com/200MB.zip
• It sends the gathered information to the following URL:
  • http://{BLOCKED}nt.red/ip.php?speed={speedtest}&uptime={uptimeinfo}&sshport={sshport}&ram={inforam}&cpumhz={cpumhz}&is32or64bit={is32or64bit}&cpucore={numberofcores}&lsb_release={release}&myusername={myusername}&hostname={myhostname}

Este malware se elimina tras la ejecución.