ELF_SETAG.TNU

2017年4月3日

解析者: Joselyn Canuela

別名:

Backdoor:Linux/Setag.A (Microsoft), Linux.Chikdos.B!gen2 (Symantec), Backdoor.Linux.Ganiw.H (BitDefender)

プラットフォーム:

Linux

危険度:

ダメージ度:

感染力:

感染確認数:

情報漏えい:

マルウェアタイプ: Backdoor
破壊活動の有無: なし
暗号化:
感染報告の有無: はい

概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

詳細

ファイルサイズ 1,135,000 bytes

タイプ ELF

発見日 2016年11月18日

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のファイルを作成します。

/{malware path}/Dest.cfg
/{malware path}/appd.log
/{malware path}/appd.conf
/user/bin/bsd-port/recei.conf
/user/bin/bsd-port/udevd.conf
/usr/lib/libamplify.so - list of IP addresses used for its DDoS capabilities
/tmp/notify.file
/proc/net/pktgen/kpktgend_{number}
/proc/net/pktgen/eth_{number}
/proc/net/pktgen/pgctrl

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

/usr/bin/oracle
/user/bin/bsd-port/recei
/user/bin/bsd-port/udevd

マルウェアは、以下のフォルダを作成します。

/usr/bin/dpkgd

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

{BLOCKED}.{BLOCKED}.163.68
{BLOCKED}.{BLOCKED}.192.68
{BLOCKED}.{BLOCKED}.213.68
{BLOCKED}.{BLOCKED}.200.101
{BLOCKED}.{BLOCKED}.2.2
{BLOCKED}.{BLOCKED}.64.1
{BLOCKED}.{BLOCKED}.88.129
{BLOCKED}.{BLOCKED}.180.2
{BLOCKED}.{BLOCKED}.78.2
{BLOCKED}.{BLOCKED}.199.68
{BLOCKED}.{BLOCKED}.3.3
{BLOCKED}.{BLOCKED}.3.8
{BLOCKED}.{BLOCKED}.144.30
{BLOCKED}.{BLOCKED}.9.9
{BLOCKED}.{BLOCKED}.9.61
{BLOCKED}.{BLOCKED}.160.110
{BLOCKED}.{BLOCKED}.7.6
{BLOCKED}.{BLOCKED}.7.17
{BLOCKED}.{BLOCKED}.0.20
{BLOCKED}.{BLOCKED}.46.151
{BLOCKED}.{BLOCKED}.195.68
{BLOCKED}.{BLOCKED}.196.115
{BLOCKED}.{BLOCKED}.196.212
{BLOCKED}.{BLOCKED}.196.228
{BLOCKED}.{BLOCKED}.196.230
{BLOCKED}.{BLOCKED}.196.232
{BLOCKED}.{BLOCKED}.196.237
{BLOCKED}.{BLOCKED}.112.10
{BLOCKED}.{BLOCKED}.17.107
{BLOCKED}.{BLOCKED}.28.231
{BLOCKED}.{BLOCKED}.28.234
{BLOCKED}.{BLOCKED}.28.237
{BLOCKED}.{BLOCKED}.6.3
{BLOCKED}.{BLOCKED}.136.10
{BLOCKED}.{BLOCKED}.140.10
{BLOCKED}.{BLOCKED}.148.37
{BLOCKED}.{BLOCKED}.148.39
{BLOCKED}.{BLOCKED}.26.42
{BLOCKED}.{BLOCKED}.32.100
{BLOCKED}.{BLOCKED}.32.103
{BLOCKED}.{BLOCKED}.32.106
{BLOCKED}.{BLOCKED}.32.109
{BLOCKED}.{BLOCKED}.33.52
{BLOCKED}.{BLOCKED}.33.60
{BLOCKED}.{BLOCKED}.3.70
{BLOCKED}.{BLOCKED}.3.70
{BLOCKED}.{BLOCKED}.3.76
{BLOCKED}.{BLOCKED}.3.79
{BLOCKED}.{BLOCKED}.3.83
{BLOCKED}.{BLOCKED}.3.85
{BLOCKED}.{BLOCKED}.4.6
{BLOCKED}.{BLOCKED}.4.9
{BLOCKED}.{BLOCKED}.4.12
{BLOCKED}.{BLOCKED}.4.15
{BLOCKED}.{BLOCKED}.4.18
{BLOCKED}.{BLOCKED}.4.21
{BLOCKED}.{BLOCKED}.96.66
{BLOCKED}.{BLOCKED}.128.106
{BLOCKED}.{BLOCKED}.98.55
{BLOCKED}.{BLOCKED}.145.194
{BLOCKED}.{BLOCKED}.151.161
{BLOCKED}.{BLOCKED}.156.66
{BLOCKED}.{BLOCKED}.152.99
{BLOCKED}.{BLOCKED}.157.99
{BLOCKED}.{BLOCKED}.29.93
{BLOCKED}.{BLOCKED}.107.85
{BLOCKED}.{BLOCKED}.255.228
{BLOCKED}.{BLOCKED}.62.142
{BLOCKED}.{BLOCKED}.33.240
{BLOCKED}.{BLOCKED}.121.27
{BLOCKED}.{BLOCKED}.160.194
{BLOCKED}.{BLOCKED}.34.10
{BLOCKED}.{BLOCKED}.70.98
{BLOCKED}.{BLOCKED}.211.22
{BLOCKED}.{BLOCKED}.128.68
{BLOCKED}.{BLOCKED}.128.86
{BLOCKED}.{BLOCKED}.128.166
{BLOCKED}.{BLOCKED}.3.140
{BLOCKED}.{BLOCKED}.4.130
{BLOCKED}.{BLOCKED}.193.97
{BLOCKED}.{BLOCKED}.2.4
{BLOCKED}.{BLOCKED}.4.1
{BLOCKED}.{BLOCKED}.61.225
{BLOCKED}.{BLOCKED}.61.235
{BLOCKED}.{BLOCKED}.61.255
{BLOCKED}.{BLOCKED}.62.1
{BLOCKED}.{BLOCKED}.62.60
{BLOCKED}.{BLOCKED}.66.66
{BLOCKED}.{BLOCKED}.176.22
{BLOCKED}.{BLOCKED}.144.47
{BLOCKED}.{BLOCKED}.192.33
{BLOCKED}.{BLOCKED}.134.33
{BLOCKED}.{BLOCKED}.134.133
{BLOCKED}.{BLOCKED}.154.15
{BLOCKED}.{BLOCKED}.196.6
{BLOCKED}.{BLOCKED}.88.88
{BLOCKED}.{BLOCKED}.243.112
{BLOCKED}.{BLOCKED}.64.33
{BLOCKED}.{BLOCKED}.164.13
{BLOCKED}.{BLOCKED}.164.18
{BLOCKED}.{BLOCKED}.225.68
{BLOCKED}.{BLOCKED}.136.68
{BLOCKED}.{BLOCKED}.224.68
{BLOCKED}.{BLOCKED}.64.129
{BLOCKED}.{BLOCKED}.240.100
{BLOCKED}.{BLOCKED}.242.18
{BLOCKED}.{BLOCKED}.245.180
{BLOCKED}.{BLOCKED}.128.68
{BLOCKED}.{BLOCKED}.118.162
{BLOCKED}.{BLOCKED}.192.67
{BLOCKED}.{BLOCKED}.198.167
{BLOCKED}.{BLOCKED}.136.81
{BLOCKED}.{BLOCKED}.1.3
{BLOCKED}.{BLOCKED}.2.18
{BLOCKED}.{BLOCKED}.192.68
{BLOCKED}.{BLOCKED}.96.65
{BLOCKED}.{BLOCKED}.164.6
{BLOCKED}.{BLOCKED}.132.2
{BLOCKED}.{BLOCKED}.199.8
{BLOCKED}.{BLOCKED}.160.68
{BLOCKED}.{BLOCKED}.166.4
{BLOCKED}.{BLOCKED}.168.8
{BLOCKED}.{BLOCKED}.222.222
{BLOCKED}.{BLOCKED}.224.68
{BLOCKED}.{BLOCKED}.227.68
{BLOCKED}.{BLOCKED}.85.85
{BLOCKED}.{BLOCKED}.88.88
{BLOCKED}.{BLOCKED}.241.1
{BLOCKED}.{BLOCKED}.64.1
{BLOCKED}.{BLOCKED}.100.100
{BLOCKED}.{BLOCKED}.224.68
{BLOCKED}.{BLOCKED}.127.1
{BLOCKED}.{BLOCKED}.93.33
{BLOCKED}.{BLOCKED}.24.129
{BLOCKED}.{BLOCKED}.241.34
{BLOCKED}.{BLOCKED}.198.230
{BLOCKED}.{BLOCKED}.0.68
{BLOCKED}.{BLOCKED}.0.117
{BLOCKED}.{BLOCKED}.24.68
{BLOCKED}.{BLOCKED}.44.150
{BLOCKED}.{BLOCKED}.0.242
{BLOCKED}.{BLOCKED}.240.6
{BLOCKED}.{BLOCKED}.158.11
{BLOCKED}.{BLOCKED}.159.3
{BLOCKED}.{BLOCKED}.111.114
{BLOCKED}.{BLOCKED}.111.122
{BLOCKED}.{BLOCKED}.127.114
{BLOCKED}.{BLOCKED}.127.122
{BLOCKED}.{BLOCKED}.129.30
{BLOCKED}.{BLOCKED}.78.210
{BLOCKED}.{BLOCKED}.254.5
{BLOCKED}.{BLOCKED}.96.112
{BLOCKED}.{BLOCKED}.225.253
{BLOCKED}.{BLOCKED}.129.81
{BLOCKED}.{BLOCKED}.129.80
{BLOCKED}.{BLOCKED}.210.98
{BLOCKED}.{BLOCKED}.210.100
{BLOCKED}.{BLOCKED}.208.3
{BLOCKED}.{BLOCKED}.208.6
{BLOCKED}.{BLOCKED}.64.68
{BLOCKED}.{BLOCKED}.192.100
{BLOCKED}.{BLOCKED}.98.3
{BLOCKED}.{BLOCKED}.98.6
{BLOCKED}.{BLOCKED}.0.68
{BLOCKED}.{BLOCKED}.64.129
{BLOCKED}.{BLOCKED}.16.99
{BLOCKED}.{BLOCKED}.5.68
{BLOCKED}.{BLOCKED}.194.55
{BLOCKED}.{BLOCKED}.200.69
{BLOCKED}.{BLOCKED}.3.141
{BLOCKED}.{BLOCKED}.3.144
{BLOCKED}.{BLOCKED}.57.33
{BLOCKED}.{BLOCKED}.0.55
{BLOCKED}.{BLOCKED}.114.114
{BLOCKED}.{BLOCKED}.115.115
{BLOCKED}.{BLOCKED}.24.34
{BLOCKED}.{BLOCKED}.135.1
{BLOCKED}.{BLOCKED}.4.66
{BLOCKED}.{BLOCKED}.143.69
{BLOCKED}.{BLOCKED}.8.141
{BLOCKED}.{BLOCKED}.0.110
{BLOCKED}.{BLOCKED}.7.1
{BLOCKED}.{BLOCKED}.32.106
{BLOCKED}.{BLOCKED}.13.101
{BLOCKED}.{BLOCKED}.255.1
{BLOCKED}.{BLOCKED}.37.1
{BLOCKED}.{BLOCKED}.1.40
{BLOCKED}.{BLOCKED}.208.46
{BLOCKED}.{BLOCKED}.9.141
{BLOCKED}.{BLOCKED}.7.90
{BLOCKED}.{BLOCKED}.224.68
{BLOCKED}.{BLOCKED}.226.68
{BLOCKED}.{BLOCKED}.90.68
{BLOCKED}.{BLOCKED}.32.178
{BLOCKED}.{BLOCKED}.69.38
{BLOCKED}.{BLOCKED}.197.58
{BLOCKED}.{BLOCKED}.6.99
{BLOCKED}.{BLOCKED}.86.18
{BLOCKED}.{BLOCKED}.189.10
{BLOCKED}.{BLOCKED}.189.18
{BLOCKED}.{BLOCKED}.249.50
{BLOCKED}.{BLOCKED}.249.54
{BLOCKED}.{BLOCKED}.64.68
{BLOCKED}.{BLOCKED}.75.68
{BLOCKED}.{BLOCKED}.1.29
{BLOCKED}.{BLOCKED}.1.53
{BLOCKED}.{BLOCKED}.204.66
{BLOCKED}.{BLOCKED}.224.8
{BLOCKED}.{BLOCKED}.224.67
{BLOCKED}.{BLOCKED}.72.65
{BLOCKED}.{BLOCKED}.91.1
{BLOCKED}.{BLOCKED}.101.3
{BLOCKED}.{BLOCKED}.96.68
{BLOCKED}.{BLOCKED}.0.81
{BLOCKED}.{BLOCKED}.152.129
{BLOCKED}.{BLOCKED}.75.123
{BLOCKED}.{BLOCKED}.154.3
{BLOCKED}.{BLOCKED}.152.3
{BLOCKED}.{BLOCKED}.1.66
{BLOCKED}.{BLOCKED}.1.66
{BLOCKED}.{BLOCKED}.128.68
{BLOCKED}.{BLOCKED}.134.68
{BLOCKED}.{BLOCKED}.106.19
{BLOCKED}.{BLOCKED}.80.65
{BLOCKED}.{BLOCKED}.192.66
{BLOCKED}.{BLOCKED}.192.68
{BLOCKED}.{BLOCKED}.1.4
{BLOCKED}.{BLOCKED}.96.5
{BLOCKED}.{BLOCKED}.96.10
{BLOCKED}.{BLOCKED}.19.40
{BLOCKED}.{BLOCKED}.19.50
{BLOCKED}.{BLOCKED}.111.118
{BLOCKED}.{BLOCKED}.255.18
{BLOCKED}.{BLOCKED}.209.5
{BLOCKED}.{BLOCKED}.209.133
{BLOCKED}.{BLOCKED}.6.2
{BLOCKED}.{BLOCKED}.1.97
{BLOCKED}.{BLOCKED}.72.1
{BLOCKED}.{BLOCKED}.112.50
{BLOCKED}.{BLOCKED}.150.66
{BLOCKED}.{BLOCKED}.6.6
{BLOCKED}.{BLOCKED}.97.234
{BLOCKED}.{BLOCKED}.97.238
{BLOCKED}.{BLOCKED}.97.242
{BLOCKED}.{BLOCKED}.2.69
{BLOCKED}.{BLOCKED}.96.68
{BLOCKED}.{BLOCKED}.32.36
{BLOCKED}.{BLOCKED}.32.39
{BLOCKED}.{BLOCKED}.200.139
{BLOCKED}.{BLOCKED}.0.124
{BLOCKED}.{BLOCKED}.54.66
{BLOCKED}.{BLOCKED}.39.73
{BLOCKED}.{BLOCKED}.10.20
{BLOCKED}.{BLOCKED}.55.244
{BLOCKED}.{BLOCKED}.150.20
{BLOCKED}.{BLOCKED}.252.16
{BLOCKED}.{BLOCKED}.1.1
{BLOCKED}.{BLOCKED}.211.193
{BLOCKED}.{BLOCKED}.211.225
{BLOCKED}.{BLOCKED}.130.1
{BLOCKED}.{BLOCKED}.1.1
{BLOCKED}.{BLOCKED}.233.1
{BLOCKED}.{BLOCKED}.192.1
{BLOCKED}.{BLOCKED}.192.174
{BLOCKED}.{BLOCKED}.224.3
{BLOCKED}.{BLOCKED}.224.5
{BLOCKED}.{BLOCKED}.16.10
{BLOCKED}.{BLOCKED}.16.11
{BLOCKED}.{BLOCKED}.96.68
{BLOCKED}.{BLOCKED}.104.68
{BLOCKED}.{BLOCKED}.160.5
{BLOCKED}.{BLOCKED}.160.185
{BLOCKED}.{BLOCKED}.32.132
{BLOCKED}.{BLOCKED}.224.68
{BLOCKED}.{BLOCKED}.73.34
{BLOCKED}.{BLOCKED}.0.130
{BLOCKED}.{BLOCKED}.1.130
{BLOCKED}.{BLOCKED}.67.4
{BLOCKED}.{BLOCKED}.67.14
{BLOCKED}.{BLOCKED}.84.58
{BLOCKED}.{BLOCKED}.84.67
{BLOCKED}.{BLOCKED}.252.8
{BLOCKED}.{BLOCKED}.128.32
{BLOCKED}.{BLOCKED}.96.9
{BLOCKED}.{BLOCKED}.100.18
{BLOCKED}.{BLOCKED}.100.21
{BLOCKED}.{BLOCKED}.94.20
{BLOCKED}.{BLOCKED}.94.241
{BLOCKED}.{BLOCKED}.1.20
{BLOCKED}.{BLOCKED}.114.133
{BLOCKED}.{BLOCKED}.114.166
{BLOCKED}.{BLOCKED}.152.130
{BLOCKED}.{BLOCKED}.150.123
{BLOCKED}.{BLOCKED}.128.33
{BLOCKED}.{BLOCKED}.72.7
{BLOCKED}.{BLOCKED}.29.68
{BLOCKED}.{BLOCKED}.29.150
{BLOCKED}.{BLOCKED}.29.170
{BLOCKED}.{BLOCKED}.131.11
{BLOCKED}.{BLOCKED}.200.68
{BLOCKED}.{BLOCKED}.150.101
{BLOCKED}.{BLOCKED}.150.139
{BLOCKED}.{BLOCKED}.144.33
{BLOCKED}.{BLOCKED}.160.33
{BLOCKED}.{BLOCKED}.192.33
{BLOCKED}.{BLOCKED}.208.33
{BLOCKED}.{BLOCKED}.224.33
{BLOCKED}.{BLOCKED}.144.161
{BLOCKED}.{BLOCKED}.5.240
{BLOCKED}.{BLOCKED}.25.129
{BLOCKED}.{BLOCKED}.103.36
{BLOCKED}.{BLOCKED}.1.227
{BLOCKED}.{BLOCKED}.252.200
{BLOCKED}.{BLOCKED}.120.5
{BLOCKED}.{BLOCKED}.96.68
{BLOCKED}.{BLOCKED}.248.219
{BLOCKED}.{BLOCKED}.248.245
{BLOCKED}.{BLOCKED}.254.34
{BLOCKED}.{BLOCKED}.244.5
{BLOCKED}.{BLOCKED}.104.15
{BLOCKED}.{BLOCKED}.104.26
{BLOCKED}.{BLOCKED}.33.227
{BLOCKED}.{BLOCKED}.107.27
{BLOCKED}.{BLOCKED}.128.68
{BLOCKED}.{BLOCKED}.192.68
{BLOCKED}.{BLOCKED}.17.2
{BLOCKED}.{BLOCKED}.203.86
{BLOCKED}.{BLOCKED}.203.90
{BLOCKED}.{BLOCKED}.203.98
{BLOCKED}.{BLOCKED}.92.86
{BLOCKED}.{BLOCKED}.92.98
{BLOCKED}.{BLOCKED}.94.20