This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
This backdoor drops the following copies of itself into the affected system:
This backdoor drops the following files:
/etc/cron.hourly/udev.sh (Cron is a time-based job scheduler in Unix-like computer operating systems)
This backdoor executes the following commands from a remote malicious user:
Start Denial of Service
Stop Denial of Service
Download and execute file
Request MD5 Hash of running malware
It connects to the following websites to send and receive information:
This backdoor connects to the following URL(s) to download its configuration file:
This backdoor drops a shell script in /etc/init.d folder which setups the autostart mechanism of the malware.
This backdoor creates five shortcut links which points to the script in /etc/init.d:
This malware is capable of doing the following flooding attack:
Minimum Scan Engine: 9.700
FIRST VSAPI PATTERN FILE: 11.952.04
FIRST VSAPI PATTERN DATE: 01 Oct 2015
VSAPI OPR PATTERN File: 11.953.00
VSAPI OPR PATTERN Date: 02 Oct 2015
Scan your computer with your Trend Micro product to delete files detected as ELF_XORDDOS.AP. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.