Trojan.Linux.SSHBRUTE.UWEJT

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan does the following:

• Upon executing, it will display the following list of arguments:
  
  • Use: scan [OPTIONS] [[USER PASS]] FILE] [IPs/IPs Port FILE]
  • Options:
  • -t [NUMTHREADS]: Change the number of threads used. Default is 10
  • -m [MODE]: Change the way the scan works. Default is 1
  • -f [FINAL SCAN]: Does a final scan on found servers. Default is 2
  • Use -f 1 for A.B class /16. Default is 2 for A.B.C /24
  • -i [IP SCAN]: use -i 0 to scan ip class A.B. Default is 1
  • if you use -i 0 then use ./scan -p 22 -i 0 p 192.168 as agrument for ip file
  • -m 0 for non selective scanning
  • -P 0 leave default password unchanged. Changes password by default.
  • -s [TIMEOUT]: Change the timeout. Default is 6
  • -S [2ndTIMEOUT]: Change the 2nd timeout. Default is 6
  • -p [PORT]: Specify another port to connect to. 0 for multiport
  • -c [REMOTE-COMMAND]: Command to execute on connect. Use ; or && with commands
  • -h : Show this help
  • -H 1: For extra help