ELF_DNSAMP.TNK

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This malware arrives via the following means:

• Apache Struts2 Remote Code Execution vulnerability (CVE-2017-5638)

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Run command in linux terminal
• Perform DDOS attacks:
  • TCP Flood
  • SYN Flood
  • UDP Flood
  • STREAM Flood
  • GET Flood
  • DNS Flood
  • UDPK Flood
  • RENT Flood

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• idc3389.{BLOCKED}2.net

Other Details

This Backdoor does the following:

• It modifies the following files as an autostart technique:
  • /etc/rc.local
  • /etc/rc.d/rc.local
• By appending the following command:
  • nohup {malware path} /dev/null 2>&1 &