Backdoor.Linux.MOZI.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Perform various DDoS attack
• Collecting Bot Information
• Execute the payload of the specified URL
• Update the sample from the specified URL
• Execute system or custom commands

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• telnetd
• utelnetd
• scfgmgr

Andere Details

Es macht Folgendes:

• It uses the following credentials to try to login to other devices:
  
  • !!Huawei
  • 00000000
  • 1111
  • 1111111
  • 1234
  • 12345
  • 123456
  • 2010vesta
  • 2011vesta
  • 54321
  • 666666
  • 7ujMko0admin
  • 7ujMko0vizxv
  • 888888
  • @HuaweiHgw
  • admin
  • admin1
  • admin1234
  • adminHW
  • Administrator
  • administrator
  • adminpass
  • anko
  • cat1029
  • CMCCAdmin
  • conexant
  • CUAdmin
  • default
  • dreambox
  • e2008jl
  • e8ehome
  • e8ehome1
  • e8telnet
  • epicrouter
  • fucker
  • GM8182
  • gpon
  • guest
  • gw1admin
  • h@32LuyD
  • hg2x0
  • hi3518
  • ikwb
  • juantech
  • jvbzd
  • keomeo
  • klv123
  • klv1234
  • meinsm
  • mother
  • pass
  • password
  • PhrQjGzk
  • plumeria0077
  • Pon521
  • r@p8p0r+
  • rapport
  • realtek
  • root
  • service
  • smcadmin
  • super
  • supervisor
  • support
  • system
  • tech
  • telnetadmin
  • ubnt
  • user
  • v2mprt
  • vizxv
  • xc3511
  • xJ4pCYeW
  • xmhdipc
  • zlxx
  • zte
  • Zte521
• It changes its process name to "sshd" if /usr/bin/python exists on the affected machine. Otherwise, it changes it to "dropbear".
• This sample uses a DHT protocol to build or establish a peer-to-peer network and uses the following public nodes to send and receive commands:
  
  • dht.transmis{BLOCKED}.com:6881
  • router.bitt{BLOCKED}.com:6881
  • bttracker.{BLOCKED}.org:6881
  • {BLOCKED}.{BLOCKED}.33.59:6881
  • {BLOCKED}.{BLOCKED}.103.244:6881
  • {BLOCKED}.{BLOCKED}.18.159:6881
  • {BLOCKED}.{BLOCKED}.162.88:6881
• It may spread to other devices by taking advantage of the following vulnerabilities:
  
  • Eir D1000 Wireless Router - WAN Side Remote Command Injection
  • SSD Advisory – Vacron NVR Remote Command Execution
  • Realtek SDK - Miniigd UPnP SOAP Command Execution
  • Netgear R7000 / R6400 - 'cgi-bin' Command Injection
  • Netgear DGN1000 1.1.00.48 - 'Setup.cgi' Remote Code Execution
  • MVPower DVR TV-7104HE 1.8.4 115215B9 - Shell Command Execution
  • Huawei Router HG532 - Arbitrary Command Execution
  • D-Link Devices - HNAP SOAPAction-Header Command Execution
  • GPON Routers - Authentication Bypass / Command Injection
  • D-Link Devices - UPnP SOAP TelnetD Command Execution
  • Multiple CCTV-DVR Vendors - Remote Code Execution