Backdoor.Linux.XORDDOS.D

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Eigenkopien in das betroffene System ein:

• /usr/bin/{random characters}
• /lib/libudev.so
• /tmp/{random characters}
• /bin/{random characters}

Autostart-Technik

Schleust die folgenden Dateien ein:

• /etc/cron.hourly/gcc.sh (Cron is a time-based job scheduler in Unix-like computer operating systems)

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Execute files
• Download files
• Update Malware
• Delete Files
• Terminate Process
• Remove Services
• Remove Self
• Perform DDoS attack
• Hide Files
• Create Services
• Create Directory
• Hide Port
• Copy Files

Sendet die folgenden Informationen an ihren Befehls- und Steuerungsserver (C&C):

• {BLOCKED}.{BLOCKED}.101.37:3306
• cdn.{BLOCKED}2cdn.com
• cdn.{BLOCKED}1num.com
• aa.f{BLOCKED}num.org/config.rar

Datendiebstahl

Folgende Daten werden gesammelt:

• Memory Information
• CPU Information
• Network Speed
• PID of Running Process
• MD5 of Running Process

Andere Details

Es macht Folgendes:

• Drops a shell script in /etc/init.d/{random character} folder which setups the auto-start mechanism of the malware.
• Creates symbolic links which points to the script in /etc/init.d/{random character}:
  • /etc/rc{1-5}.d/S90{random numbers}
  • /etc/rc.d/rc{1-5}.d/S90{random numbers}
• Read the following from its configuration file:
  • md5 - checksum of file
  • denyip - open communication with an IP
  • filename - list of filename
  • rmfile - files to remove
• Uses the following User Agents:
  • POST/GET %s HTTP/1.1 /
    Accept: */*
    Accept-Language: zh-cn
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ;.NET CLR 1.1.4322)
    Connection: Keep-Alive
    Host:
    Content-Type: application/x-www-form-urlencoded
    Content-Length:
• Get the magic string value from the file /var/run/gcc.pid
• It modify /bin/chkconfig to add its copy as a service.