Backdoor.SH.PIMINE.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra y ejecuta los archivos siguientes:

• /opt/{random characters} -> a copy it drops if the script is not running as root

Crea las carpetas siguientes:

• /root/.ssh

Otras modificaciones del sistema

Elimina los archivos siguientes:

• /root/.bashrc
• /home/pi/.bashrc
• /tmp/ktx*
• /tmp/cpuminer-multi
• /var/tmp/kaiten

Rutina de puerta trasera

Se conecta a uno de los servidores de IRC siguientes:

• ix1.{BLOCKED}et.org
• ix2.{BLOCKED}et.org
• Ashburn.Va.Us.{BLOCKED}et.org
• Bucharest.RO.EU.{BLOCKED}et.Org
• Budapest.HU.EU.{BLOCKED}et.org
• Chicago.IL.US.{BLOCKED}et.org

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• bins.sh
• minerd
• node
• nodejs
• ktx-armv4l
• ktx-i586
• ktx-m68k
• ktx-mips
• ktx-mipsel
• ktx-powerpc
• ktx-sh4
• ktx-sparc
• arm5
• zmap
• kaiten
• perl

Otros detalles

Hace lo siguiente:

• Executes the following commands to download libraries needed:
  • apt-get update -y --force-yes
  • apt-get install zmap sshpass -y --force-yes
• Scans for networks with an open port 22 using Zmap and uses the credentials username: pi and password: raspberry or raspberryraspberry993311 to drop a copy and execute it.
• Executes the following commands to change the password of user pi:
  • usermod -p \$6\$vGkGPKUr\$heqvOhUzvbQ66Nb0JGCijh/81sG1WACcZgzPn8A0Wn58hHXWqy5yOgTlYJEbOjhkHD0MRsAkfJgjU/ioCYDeR1 pi
• Allowed root to log in using this ssh key:
  • {BLOCKED}SIufmqpqg54D6s4J0L7XV2kep0rNzgY1S1IdE8HDef7z1ipBVuGTygGsq+x4yVnxveGshVP48YmicQHJMCIljmn6Po0RMC48qihm/9ytoEYtkKkeiTR02c6DyIcDnX3QdlSmEqPqSNRQ/XDgM7qIB/VpYtAhK/7DoE8pqdoFNBU5+JlqeWYpsMO+qkHugKA5U22wEGs8xG2XyyDtrBcw10xz+M7U8Vpt0tEadeV973tXNNNpUgYGIFEsrDEAjbMkEsUw+iQmXg37EusEFjCVjBySGH3F+EQtwin3YmxbB9HRMzOIzNnXwCFaYU5JjTNnzylUBp/XB6B
• Executes the following commands so that it will run upon boot:
  • sudo sh -c "echo '#!/bin/sh -e' > /etc/rc.local"
  • sudo sh -c "echo /opt/$NEWMYSELF >> /etc/rc.local"
  • sudo sh -c "echo 'exit 0' >> /etc/rc.local"