Backdoor.Linux.BASHLITE.AMF

This is an updated Bashlite malware designed to add infected internet-of-things devices to a distributed-denial-of-service (DDoS) botnet.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• PINGING - checks connection with the C&C
• ECHOSCAN – telnet scanner
• OELINUX123 – similar to ECHOSCAN, but targets embedded systems
• CFBYPASS – bypasses CloudFlare Protection
• BRICKER – downloads and executes bricker
• MINER - downloads and executes miner
• PKILL - kills a specified process
• GRENADE – launches all DDOS module
  • JUNK - send randomly generated strings
  • UDP - send UDP packets
  • ACK - send ACK packets
  • VSE - send spoofed queries and/or connection attempts
  • TCP - send TCP packets
  • OVH - flood OVH an anti-DDoS web service

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.25.213:3437

Other Details

This Backdoor does the following:

• It uses the following credentials to try to login to other machines:
  • Username:
    • root
    • admin
  • Password:
    • root
    • admin
    • admin123
    • huigu309
    • xc3511
    • vizxv
• It is capable of dropping downloader binaries depending on the system architecture.
  The dropped binary accesses the following URL to download its payload:
  • {BLOCKED}.{BLOCKED}.185.250/hakai.{architecture}
    where {architecture} is any of the following:
    • arm
    • arm7
    • m68k
    • mips
    • mpsl
    • ppc
    • sh4
    • spc
    • x86
    • x86_64
  
  The dropped binary saves its downloaded file using the following name:
  • hakai