Trojan.SH.BROOTKIT.A

February 21, 2020
 Analysis by: Joshua Paul Ignacio
 ALIASES:

HEUR:Trojan.Shell.Agent.u (KASPERSKY); BV:Agent-BGD [Trj] (AVAST)

 PLATFORM:

Linux

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It executes downloaded files whose malicious routines are exhibited by the affected system.

However, as of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size:

35,104 bytes

File Type:

Other

Memory Resident:

No

Initial Samples Received Date:

12 Feb 2020

Payload:

Terminates processes, Deletes files, Drops files, Executes files

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

  • /usr/lib/...
  • /tmp/...

It drops the following copies of itself into the affected system:

  • /usr/lib/.../diskmanagerd
  • /tmp/.../diskmanagerd
  • /tmp/.../just4root

It executes then deletes itself afterward.

Other System Modifications

This Trojan deletes the following files:

  • /usr/lib/.../diskmanagerd
  • /tmp/.../just4run
  • /tmp/.../pxe
  • /tmp/.../pxe.c
  • /tmp/.../.d1r7y.txt
  • /tmp/.h
  • /tmp/.hh
  • /tmp/.helpdd
  • /tmp/.../
  • /tmp/.../brootkit.sh
  • /tmp/.../install.sh
  • /tmp/vxbkyxrlq2hly2s
  • /usr/lib/.../kacpi_notify
  • /tmp/moni.lod
  • /tmp/gates.lod
  • /etc/init.d/selinux
  • /etc/init.d/DbSecuritySpt
  • /etc/rc1.d/S97DbSecuritySpt
  • /etc/rc2.d/S97DbSecuritySpt
  • /etc/rc3.d/S97DbSecuritySpt
  • /etc/rc4.d/S97DbSecuritySpt
  • /etc/rc5.d/S97DbSecuritySpt
  • /usr/bin/bsd-port/conf.n
  • /usr/bin/bsd-port/getty
  • /usr/bin/bsd-port/getty.lock
  • /tmp/pythompy
  • /etc/rc1.d/S99selinux
  • /etc/rc2.d/S99selinux
  • /etc/rc3.d/S99selinux
  • /etc/rc4.d/S99selinux
  • /etc/rc5.d/S99selinux

Dropping Routine

This Trojan drops the following files:

  • /tmp/.helpdd
  • /etc/cron.hourly/gcc4lef.sh
  • /tmp/.../just4run

Download Routine

This Trojan executes downloaded files :

  • /tmp/diskmanagerd → Downloaded from http://owa.{BLOCKED}g.com/shell
  • /tmp/diskmanagerd → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/shell
  • /tmp/.../brootkit.sh (Detected as Rootkit.SH.BROOTKIT.A)→ Downloaded from http://owa.{BLOCKED}g.com/l/tiktoor/brootkit.sh
  • /tmp/.../brootkit.sh (Detected as Rootkit.SH.BROOTKIT.A) → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/tiktoor/brootkit.sh
  • /tmp/.../install.sh (Detected as Trojan.SH.BROOTKIT.B) → Downloaded from http://owa.{BLOCKED}g.com/l/tiktoor/install.sh
  • /tmp/.../install.sh (Detected as Trojan.SH.BROOTKIT.B) → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/tiktoor/install.sh
  • /tmp/.../pxe.c → Downloaded from http://owa.{BLOCKED}g.com/l/pxe/dtC.c
  • /tmp/.../pxe.c → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/pxe/dtC.c
  • /tmp/.../pxe.c → Downloaded from http://owa.{BLOCKED}g.com/l/pxe/dtU.c
  • /tmp/.../pxe.c → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/pxe/dtU.c
  • /tmp/.../pxe (Detected as Trojan.Linux.CVE20165195.D) → Downloaded from http://owa.{BLOCKED}g.com/l/pxe/dtC
  • /tmp/.../pxe (Detected as Trojan.Linux.CVE20165195.D) → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/pxe/dtC
  • /tmp/.../pxe (Detected as Trojan.Linux.CVE20165195.C) → Downloaded from http://owa.{BLOCKED}g.com/l/pxe/dtU
  • /tmp/.../pxe (Detected as Trojan.Linux.CVE20165195.C) → Downloaded from http://{BLOCKED}.{BLOCKED}.140.59/l/pxe/dtU
whose malicious routines are exhibited by the affected system.

Other Details

This Trojan does the following:

  • It creates the following cron jobs for persistence:
    • Path: /etc/cron.hourly/gcc4lef.sh
    • Schedule: Every 3 minutes
    • Command: */3 * * * * root /etc/cron.hourly/gcc4lef.sh
  • It does the following once an Anti-Virus program is running on the affected machine:
    • safedog
      • Uninstall the following:
        • sddev
      • Terminates the following:
        • safedog
        • sdmonitor
        • sdcc
        • udcenter
        • sdcmd
        • sdsvrd
        • Sdacm
        • Udpro
        • sduibin
      • Deletes the following:
        • /etc/sd_uninstall
        • /etc/init.d/sdccboot
        • /etc/init.d/safedog
        • /etc/init.d/sdboot
        • /etc/init.d/udboot
        • /etc/rc2.d/S99sdccboot
        • /etc/rc3.d/S99sdccboot
        • /etc/rc4.d/S99sdccboot
        • /etc/rc5.d/S99sdccboot
        • /etc/rc2.d/S99udboot
        • /etc/rc3.d/S99udboot
        • /etc/rc4.d/S99udboot
        • /etc/rc5.d/S99udboot
        • /etc/rc2.d/S99sdboot
        • /etc/rc3.d/S99sdboot
        • /etc/rc4.d/S99sdboot
        • /etc/rc5.d/S99sdboot
        • /usr/bin/sdcc
        • /usr/bin/sdmonitor
        • /usr/bin/sd_autoexmn
        • /usr/bin/runsdcc
        • /usr/bin/sdccboot
        • /usr/bin/udboot
        • /usr/bin/udcenter
        • /usr/bin/udpro
        • /usr/bin/sdalarm
        • /usr/bin/sdsetos
        • /usr/bin/safedog_uninstall
        • /usr/bin/safedog
        • /usr/bin/sdboot
        • /usr/bin/sdstart
        • /usr/bin/sdsvrd
        • /usr/bin/sdwebdir
        • /usr/bin/sdrtdefendupdate
        • /usr/bin/sdcmd
        • /usr/bin/sdtest
        • /usr/bin/sdui
        • /usr/bin/sduibin
        • /usr/bin/sdcloud
        • /usr/bin/udinstall
        • /usr/bin/sdacm
        • /usr/bin/sdrepo
        • /usr/bin/uduninstall
        • /usr/bin/SDDownload
        • /etc/sdinfo.conf
        • /etc/udcenter.conf
        • /etc/safedog
        • /etc/safedog/libs/safedog
        • /etc/safedog/libs/sdcommon
        • /etc/safedog/libs/sdcc
        • /etc/cloudhelper
        • /etc/init.d/sdccboot
        • /etc/init.d/rc2.d/S99sdccboot
        • /etc/init.d/rc3.d/S99sdccboot
        • /etc/init.d/rc4.d/S99sdccboot
        • /etc/init.d/rc5.d/S99sdccboot
        • /etc/rc2.d/S99sdccboot
        • /etc/rc3.d/S99sdccboot
        • /etc/rc4.d/S99sdccboot
        • /etc/rc5.d/S99sdccboot
        • /etc/safedog/sdcc/bin/sdcc
        • /usr/bin/sdcc
        • /etc/safedog/sdcc/script/runsdcc
        • /usr/bin/runsdcc
        • /etc/safedog/sdcc/script/sdccboot
        • /usr/bin/sdccboot
        • /etc/safedog/logs/sdcc.log
        • /etc/safedog/sdcc/script/udboot
        • /etc/safedog/sdcc/bin/udcenter
        • /etc/safedog/sdcc/bin/udpro
        • /etc/safedog/sdcc/bin/sdalarm
        • /etc/safedog/server/script/sdsetos
        • /etc/safedog/script/safedog_uninstall
        • /etc/sd_uninstall/
    • aegis
      • Uninstall the following:
        • /etc/init.d/aegis
      • Terminates the following:
        • /etc/init.d/aegis
        • aegis_cli
        • aegis_update
        • AliYunDun
        • AliHids
        • AliYunDunUpdate
      • Deletes the following:
        • /etc/init.d/aegis
        • /etc/runlevels/default/aegis
        • /etc/rc2.d/S80aegis
        • /etc/rc3.d/S80aegis
        • /etc/rc4.d/S80aegis
        • /etc/rc5.d/S80aegis
        • /etc/rc.d/rc2.d/S80aegis
        • /etc/rc.d/rc3.d/S80aegis
        • /etc/rc.d/rc4.d/S80aegis
        • /etc/rc.d/rc5.d/S80aegis
        • /usr/local/aegis/aegis_client
        • /usr/local/aegis/aegis_update
        • /usr/local/aegis/alihids
    • yunsuo
      • Uninstall the following:
        • /usr/local/yunsuo_agent
      • Terminates the following:
        • yunsuo
        • /etc/init.d/yunsuo
      • Deletes the following:
        • /etc/init.d/yunsuo
    • clamd
      • Terminates the following:
        • clamd
        • /etc/init.d/avast
      • Deletes the following files:
        • all files related to clamav
    • avast
      • Terminates the following:
        • avast
        • /etc/init.d/avast
      • Deletes the following:
        • all files related to avast
    • avgd
      • Terminates the following:
        • avgd
        • /etc/init.d/avgd
      • Deletes the following:
        • /opt/avg/
        • all files related to avg
    • cmdavd and cmdmgd
      • Terminates the following:
        • cmdavd
        • Cmdmgd
        • /etc/init.d/cmdavd
        • /etc/init.d/cmdmgd
      • Deletes the following:
        • /opt/COMODO
        • all files related to CAV_LINUX
    • drweb-configd and drweb-spider-kmod
      • Terminates the following:
        • drweb-spider-kmod
        • drweb-configd
        • /etc/init.d/drweb-spider-kmod
        • /etc/init.d/drweb-configd
      • Deletes the following:
        • /opt/drweb.com
        • all files related to drweb
    • esets
      • Terminates the following:
        • /etc/init.d/esets
      • Deletes the following:
        • /opt/eset/
    • xmirrord
      • Uninstall the following:
        • /usr/share/xmirror/scripts
      • Terminates the following:
        • xmirrord
        • /etc/init.d/xmirrord
      • Deletes the following:
        • all files related to xmirrord

However, as of this writing, the said sites are inaccessible.

It checks for the presence of the following antivirus and security applications:

  • safedog
  • aegis
  • yunsuo
  • clamd
  • avast
  • avgd
  • cmdavd
  • cmdmgd
  • drweb-configd
  • drweb-spider-kmod
  • esets
  • xmirrord

  SOLUTION

Minimum Scan Engine:

9.850

FIRST VSAPI PATTERN FILE:

15.694.07

FIRST VSAPI PATTERN DATE:

19 Feb 2020

VSAPI OPR PATTERN File:

15.695.00

VSAPI OPR PATTERN Date:

20 Feb 2020

Scan your computer with your Trend Micro product to delete files detected as Trojan.SH.BROOTKIT.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.