Trojan.Linux.ZYX.USELVF319

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://w.{BLOCKED}n.com:43768/init.sh

Other Details

This Trojan does the following:

• It replaces the original rm of the system to perform malicious routine when rm is called and will still execute the original rm in /usr/bin/rmm.
• It removes the immutable and append only properties of the following files and reverts it back after execution:
  • /var/spool/cron
  • /var/spool/cron/root
• It does the following commands to create a scheduled task or cron job:
  • cat \'/var/spool/cron/root\' |grep init.sh 318
  • echo >> /var/spool/cron/root
• It does the following commands:
  • chmod 644 /var/spool/cron/root
  • chattr +ia /etc/cron.d

However, as of this writing, the said sites are inaccessible.