Backdoor.Linux.KERDOOR.C

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• kadtg_{PID} → Creates multiple instances sequentially, with a new instance created after the previous one terminates.

Other Details

This Backdoor requires the following additional components to properly run:

• {kernel module} → A kernel module is required to be loaded by the malware

It does the following:

• It runs as a background process and creates processes using the following naming format:
  • kadtg_{PID}
• It repeatedly creates IPv4 TCP sockets and sends a custom IOCTL request.
• It disables the creation of core dump files.
• It attempts to run with root user and group privileges.
• It attempts to access SELinux security settings
• It redirects its standard input, output, and error to `/dev/null`.
• This variant attempts to load the kernel module `tschook.ko` (detected as Backdoor.Linux.KERDOOR.D)

It accepts the following parameters:

• {kernel module}