ELF_CDORKED.A

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Update URLs for redirection
• Update whitelisted and blacklisted User-Agents
• Update blacklisted IP range list
• Update whitelisted IP range list
• Update list of blacklisted pages
• Update list of whitelisted pages
• Update list of excluded Accept-Language
• Show server status

NOTES:

It redirects users to websites with the following format:

• http://{16 random characters}.{domain name}/index.php?{letter}={encoded base64 string}

The following strings are used to check the server name:

• adm
• bill
• bucks
• cpanel
• host
• memb
• mrtg
• secur
• stat
• submit
• support
• webmaster
• webmin

The commands are sent to the infected server via HTTP request through a specially crafted URL.