Trojan.SH.CUTTLESNIFF.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de infiltración

Este malware infiltra el/los siguiente(s) archivo(s), en el cual/los cuales guarda la información recopilada:

• /tmp/co.tmp → deleted afterwards

Robo de información

Recopila los siguientes datos:

• Contents of directories
• Running processes
• Network Connections
• Mounted devices

Otros detalles

Hace lo siguiente:

• It creates a tar compressed file /tmp/co.tmp.tar.gz → deleted afterwards
  • containing the previously created temporary file and the /etc/config directory
• It tries to download different versions of a file based on different architectures (like arm, i386, i386_i686, i386_x64, mips32, mips64)
• Each downloaded file is saved as /tmp/.timezone, made executable, and then run with certain parameters:
  • -f /tmp/co.tmp.tar.gz : Specifies the file to be uploaded.
  • -u https://www.{BLOCKED}as.com/upload : Specifies the URL to which the file will be uploaded.
  • -a : enables the append mode.
  • -b 5000 : Sets the buffer size to 5000 bytes
  • -z : Enables Compression
  • -d : Enables the delete option