ELF_MANUST.SM

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It joins an Internet Relay Chat (IRC) channel. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor connects to any of the following IRC server(s):

• x.{BLOCKED}shellz.net:25

It joins any of the following Internet Relay Chat (IRC) channels:

• #micro

It executes the following commands from a remote malicious user:

• Perform PUSH-ACK flood
• Perform SYN flood
• Perform UDP flood with spoofed source address
• Perform UDP flood without spoofed source address
• Change nickname
• Change server
• Get spoofed source addresses
• Set spoofed address subnet mask
• Disable client
• Enable client
• Terminate client
• Download file
• Stop all attacks
• Send raw IRC command
• Start remote shell

NOTES:

The IRC nickname it uses is a randomly generated string. It creates and locks the file /tmp/.z to ensure that only one copy of itself is running.