arrow_back
search
close

Backdoor.Perl.SHELLBOT.D

July 19, 2019
 Analysis by: Earle Maui Earnshaw
 ALIASES:

HEUR:Backdoor.Perl.IRCBot.mr(Kaspersky); Backdoor:Perl/Shellbot.S(Microsoft)

 PLATFORM:

Windows, Unix, Linux

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Backdoor

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet

This backdoor is downloaded and installed in systems via malicious URL. It is installed with a miner.

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

  TECHNICAL DETAILS

File Size:

26,696 bytes

File Type:

PL

Memory Resident:

Yes

Initial Samples Received Date:

08 Jul 2019

Payload:

Connects to URLs/IPs, Downloads files

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

  • http://{BLOCKED}.{BLOCKED}.52.55/uploads/sshd2
  • http://{BLOCKED}.{BLOCKED}.202.28/.wp/sshd2

Backdoor Routine

This Backdoor connects to any of the following IRC server(s):

  • {BLOCKED}ers.ry:80

It joins any of the following IRC channel(s):

  • #ssh

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

  • IRC Control:
    • join → Join a channel
    • part → Leave a channel
    • rejoin → Leave and rejoin a channel
    • op → Grant a user an operator status
    • deop → revoke a user's operator status
    • voice → grant user a voice status
    • devoice → revoke a user's voice status
    • msg → send a private message
    • flood → send a private message for a specified number of times
    • ctcpflood → send a client-to-client protocol request to a specified user or channel for a specified number of times
    • ctcp → send a client-to-client protocol to a specified user or channel
    • invite → invite a user to join a specified channel
    • nick → change nickname
    • send → establish a direct connection with another user
    • raw → toggles raw events processing
    • eval → execute a specified command
    • quit → Disconnect from the IRC server
    • rand → change nickname to ssh.{random number}
    • jump → connect to a specified server
    • bang → toggles packets flag
    • stat → toggles statistics flag
    • rp → leave a channel after random seconds
    • rj → join a channel after random seconds
  • UDP Flooding
  • Simultaneous IGMP, ICMP, UDP and TCP flooding on open ports with statistic report
  • Connect to an arbitrary socket
  • Download a file
  • Scans for the following ports 21, 22, 23, 25, 53, 80, 110, 113, 143, 3306, 4000, 5900, 6667, 6668, 6669, 7000, 10000, 12345, 31337, 65501 of a specific IP

  SOLUTION

Minimum Scan Engine:

9.850

FIRST VSAPI PATTERN FILE:

15.224.03

FIRST VSAPI PATTERN DATE:

09 Jul 2019

VSAPI OPR PATTERN File:

15.225.00

VSAPI OPR PATTERN Date:

10 Jul 2019

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to delete files detected as Backdoor.Perl.SHELLBOT.D. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.