Backdoor.Linux.BASHLITE.WL

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• TELNETSCANNER - SCANS and INFECT devices with weak credentials
• FLOAD - TELNETSCANNER flood
• UPDATE - download updated binary from C&C
• HTTP - HTTP flood
• CLOUDFLATE - HTTP flood with CLOUDFLARE protection bypass
• DOMINATE - HTTP flood with DGA
• CNC - set CNC
• HOLD - STOP current flood
• JUNK - SEND random strings
• UDP - UDP flood
• XMAS - XMAS flood
• TCP - TCP flood
• STD - STD flood
• STOMP - STD, TCP and DOMINATE command
• STOP - STOP bot

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.195.33:42516

Other Details

This Backdoor does the following:

• It is capable of dropping downloader binaries depending on the system architecture.
  The dropped binary accesses the following URL to download its payload:
  • http://{BLOCKED}.{BLOCKED}.195.33/assailant.{architecture}
    where {architecture} is any of the following"
  • Mips
  • Mps1
  • Sh4
  • X86
  • Arm6
  • I686
  • Ppc
  • I586
  • M68k
  • Sparc
  • Arm4
  • Arm5
  • Arm7
  • ppc440fp