ELF_KAITEN.SME

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Se conecta a servidores de IRC. Se une a un canal de IRC.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Se conecta a alguno de los siguientes servidores de IRC:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.23:443

Se une a alguno de los canales siguientes de IRC:

• #roots

Otros detalles

Hace lo siguiente:

• It adds the line "/" to either of the following startup scripts to enable its automatic execution at every system startup:
  • /etc/rc.d/rc.local
  • /etc/rc.conf
• It disguises itself as a legitimate process by executing using the following process names:
  • master
  • crond
  • -bash
• It accesses the following file to generate random strings:
  • /usr/dict/words