Backdoor.Linux.XORDDOS.B

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• /bin/{random character}

Autostart Technique

This Backdoor drops the following files:

• /etc/cron.hourly/{random character}.sh (Cron is a time-based job scheduler in Unix-like computer operating systems)

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute files
• Download files
• Update Malware
• Delete Files
• Terminate Process
• Remove Services
• Remove Self
• Perform DDoS attack
• Hide Files
• Create Services
• Create Directory
• Hide Port
• Copy Files

It posts the following information to its command and control (C&C) server:

• {BLOCKED}.{BLOCKED}.111.129:80
• {BLOCKED}.{BLOCKED}.111.130:80
• {BLOCKED}.{BLOCKED}.111.131:80
• {BLOCKED}.{BLOCKED}.126.236:80
• {BLOCKED}.{BLOCKED}.126.237:80
• {BLOCKED}.{BLOCKED}.126.238:80
• {BLOCKED}.{BLOCKED}.126.239:80
• kill{BLOCKED}fly.com
• p6.s{BLOCKED}.net
• p6.f{BLOCKED}9.com

Information Theft

This Backdoor gathers the following data:

• Memory Information
• CPU Information
• Network Speed
• PID of Running Process
• MD5 of Running Process

Other Details

This Backdoor does the following:

• Drops a shell script in /etc/init.d/{random characters} folder which setups the auto-start mechanism of the malware.
• Creates symbolic links which points to the script in /etc/init.d/{random characters}:
  • /etc/rc{1-5}.d/S90{random numbers}
  • /etc/rc.d/rc{1-5}.d/S90{random numbers}
• Read the following from its configuration file:
  • md5 - checksum of file
  • denyip - open communication with an IP
  • filename - list of filename
  • rmfile - files to remove
• Uses the following User Agents:
  • POST %s HTTP/1.1
    Accept:
    Accept-Language: zh-cn
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
    Host:
    Content-Type: application/x-www-form-urlencoded
    Content-Length:
    Connection: Keep-Alive
  • GET %s HTTP/1.1
    Accept: */*
    Accept-Language: zh-cn
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
    Host:
    Connection: Keep-Alive
  • GET %s HTTP/1.1
    Accept: */*
    Accept-Language: en
    User-Agent:Wget/1.12 (linux-gnu)
    Host:
    Connection: Keep-Alive