Backdoor.Linux.BASHLITE.SMJC3

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• UDP - UDP flood or UDP flood with random strings
• XMAS - TCP flood (flags are set to high)
• VSE - VSE flood or VSE flood with random strings
• TCP - TCP flood with a flag set to high or all flags set to high (XMAS)
• STD - UDP flood with specific strings.
• HEX STOP - stop bot operation

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• 192.{BLOCKED}.{BLOCKED}.154:6535

Other Details

This Backdoor does the following:

• It accesses /proc/net/route to obtain the gateway.
• It connects to the Google's DNS server to obtain the IP address.