Backdoor.Linux.ELECTRORAT.YABA-A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• /home/{username}/.mdworker → Hidden

It drops the following files:

• /home/{username}/.config/autostart/mdworker.desktop

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute Console Commands
• Get Folder Content
• Upload Folders
• Upload/Download Files
• Get Process List
• Terminate Processes
• Take Screenshots
• Start Keylogger

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.100.140

Information Theft

This Backdoor gathers the following data:

• Machine ID
• Username
• Computer Name
• OS Version
• OS Name

Other Details

This Backdoor does the following:

• It connects to the following url to retrieve its C&C:
  • https://pastebin.com/raw/{BLOCKED}kd
  • https://pastebin.com/raw/{BLOCKED}C7