ELF_ROOPRE.E

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Q - Sends additional data and information
• P - Sends current state of running tasks, or count of current working threads
• R - Refresh the session with C&C server
• F - Download file drom C&C server
• L - Set maximum number of threads and connection timeout, or load a shared library
• S - Stop all threads executing the loaded shared library routines
• G - Create threads to execute exported functions of loaded shared libraries

It connects to the following websites to send and receive information:

• http://{BLOCKED}atelit.biz/ololo.php