TrojanSpy.SH.HADGLIDER.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It deletes itself after execution.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• Trojan.SH.HADGLIDER.A

Installation

This Trojan Spy drops the following files:

• /usr/bin/.rksu_sysi.lock → infection marker
• /tmp/.rksu_sysi.lock → infection marker

Information Theft

This Trojan Spy gathers the following data:

• Download Speed
• Uptime
• SSH Port
• RAM Information
• CPU Architecture
• Processor Architecture
• Number of Processors
• Linux Distribution
• User Name
• Host Name

Other Details

This Trojan Spy does the following:

• It terminates itself if any of the following files exist:
  • /usr/share/.workingS
  • /usr/share/.sysinfo
  • /usr/bin/.rksu_sysi.lock
  • /tmp/.rksu_sysi.lock
• It connects to the following URL to get the infected machine's download speed:
  • http://ipv4.download.{BLOCKED}band.com/200MB.zip
• It sends the gathered information to the following URL:
  • http://{BLOCKED}nt.red/ip.php?speed={speedtest}&uptime={uptimeinfo}&sshport={sshport}&ram={inforam}&cpumhz={cpumhz}&is32or64bit={is32or64bit}&cpucore={numberofcores}&lsb_release={release}&myusername={myusername}&hostname={myhostname}

It deletes itself after execution.