Backdoor.Linux.EMEXIE.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk. It connects to a website to send and receive information. However, as of this writing, the said sites are inaccessible.

As of this writing, the said sites are inaccessible.

It takes advantage of certain vulnerabilities.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following command(s) from a remote malicious user:

• Terminates itself
• Propagates using specific exploits
• Scans for vulnerable targets, specifically the following services/servers:
  • Redis
  • CouchDB
  • Exim
  • Jenkins
  • Nexus
  • Jira
• Perform brute force attack on the following services/servers:
  • Redis
  • CouchDB

It connects to the following websites to send and receive information:

• https://{BLOCKED}rjbcasuikp.onion.to
• https://{BLOCKED}4e.ngrok.io
• https://{BLOCKED}b6.ngrok.io

However, as of this writing, the said sites are inaccessible.

Download Routine

This Backdoor connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}in.com/raw/Dj3JTtnj

It saves the files it downloads using the following names:

• /tmp/baby -> coinminer payload

As of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following data:

• Username
• Hostname
• IP Address
• Operating System Platform

Other Details

This Backdoor takes advantage of the following vulnerabilities:

• Redis Lua Bytecode Privilege Escalation
• Jenkins up to 2.153/LTS 2.138.3 Stapler Web Framework Metaclass.Java URL Remote Code Execution
• Apache CouchDB Remote Code Execution
• Exim Remote Code Execution
• Nexus Repository Manager 3 Remote Code Execution
• Atlassian JIRA Template Injection Vulnerability Remote Code Execution