ELF_KAITEN.SML

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It joins an Internet Relay Chat (IRC) channel. It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor opens the following ports:

• 2275

It connects to any of the following IRC server(s):

• {BLOCKED}.{BLOCKED}.216.2

It joins any of the following Internet Relay Chat (IRC) channels:

• #whatever

It executes the following commands from a remote malicious user:

• TSUNAMI
• PAN
• UDP
• UNKNOWN
• NICK
• SERVER
• GETSPOOFS
• SPOOFS
• DISABLE
• ENABLE
• KILL
• GET
• VERSION
• KILLALL
• HELP
• IRC
• SH

Other Details

This Backdoor does the following:

• Execute shell commands
• Download and execute files
• Execute DDOS Attacks
• Communicate via IRC channels

It uses the following credentials when accessing its IRC server:

• NICK = {random}
• USER = {random}
• KEY = "bleh"