Backdoor.Linux.BASHLITE.WWLL

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• RHTTP - HTTP FLOOD
• TCP - TCP FLOOD with customizable TCP FLAGS (may perform XMAS flood)
• UDP - UDP flood or UDP flood with random strings
• RVSE - VSE flood or VSE flood with random strings
• RSTD - UDP flood with specific strings
• STOP,stop,Stop - kill bot operation

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.138.188:4554

Other Details

This Backdoor does the following:

• It can report the OS,PORT and ARCHITECTURE to the CNC server.
• It connects to Google to get the IP address of the infected machine.