Backdoor.Linux.RSHell.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• /bin/netstat ← the original netstat is moved with a different filename which is "/bin/scnetstat"

Other System Modifications

This Trojan deletes the following files:

• /bin/ddus-uidgen
• /etc/init.d/acpidtd
• /etc/rc.d/rc*.d/S01acpidtd
• /etc/ld.sc.conf

Backdoor Routine

This Trojan executes the following commands from a remote malicious user:

• Execute shell commands

It connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.30.212
• {BLOCKED}.{BLOCKED}.33.59
• {BLOCKED}.{BLOCKED}.32.135
• {BLOCKED}.{BLOCKED}.202.186
• {BLOCKED}.{BLOCKED}.116.233
• {BLOCKED}.{BLOCKED}.214.158
• {BLOCKED}.{BLOCKED}.90.199
• {BLOCKED}.{BLOCKED}.199.236
• {BLOCKED}.{BLOCKED}.33.242

Other Details

This Trojan does the following:

• Names the executed process with any within the following list:
  • [aio]
  • [async]
  • [ata]
  • [ata_aux]
  • [bdi-default]
  • [cpuset]
  • [crypto]
  • [ecryptfs-kthrea]
  • [eventsli>[ext4-dio-unwrit]
  • [flush-251:0]
  • [flush-8:0]
  • [jbd2]
  • [kacpi_hotplug]
  • [kacpi_notify]
  • [kacpid]
  • [kblockd]
  • [kconservative]
  • [kdmflush]
  • [khelper]
  • [khubd]
  • [khungtaskd]
  • [kintegrityd]
  • [kmmcd]
  • [kmpath_handlerd]
  • [kmpathd]
  • [kondemand]
  • [kpsmoused]
  • [kseriod]
  • [ksmd]
  • [ksnapd]
  • [ksoftirqd]
  • [kstriped]
  • [ksuspend_usbd]
  • [kswapd0]
  • [kswapd1]
  • [kthreadd]
  • [migration]
  • [netns]
  • [pm]
  • [scsi_eh_0]
  • [sync_supers]
  • [usbhid_resumer]
  • [watchdog]
  • [xfs_mru_cache]
  • [xfsaild]
  • [xfsbufd]
  • [xfsconvertd]
  • [xfsdatad]
  • [xfslogd]
  • [xfssyncd]