ELF_KAITEN.SME

该后门程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

它会连接互联网中继聊天（IRC）服务器，并加入互联网中继聊天（IRC）频道。

Arrival Details

该后门程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

Backdoor Routine

该后门程序会连接以下任意互联网中继聊天（IRC）服务器：

• {BLOCKED}.{BLOCKED}.{BLOCKED}.23:443

它会加入以下任意互联网中继聊天（IRC）频道：

• #roots

它会访问远程互联网中继聊天（IRC）服务器，并从远程恶意用户处接收以下命令：

• PING → return "PONG"
• NICK → change nickname
• PRIVMSG:
  • TSUNAMI → TCP Flood Attack
  • PAN → SYN Flood Attack
  • UDP → UDP Flood Attack
  • UNKNOWN → UDP Flood Attack (Non-spoof)
  • NICK → change or set nickname
  • SERVER → change server
  • GETSPOOFS → create spoofing parameters
  • SPOOFS → change spoofing to subnet
  • DISABLE → stop bot
  • ENABLE → continue running bot
  • KILL → terminates running bot instance
  • KILLALL → terminates all running bot instances
  • GET → download file from a web address
  • VERSION → sends "Kaiten wa goraku"
  • HELP → list all commands
  • IRC → sends commands to the server
  • SH → executes a command
• 376 → MODE, JOIN, WHO
• 433 → set nickname
• 352 → spoof request

其他信息

该后门程序会执行以下操作：

• It adds the line "/" to either of the following startup scripts to enable its automatic execution at every system startup:
  • /etc/rc.d/rc.local
  • /etc/rc.conf
• It disguises itself as a legitimate process by executing using the following process names:
  • master
  • crond
  • -bash
• It accesses the following file to generate random strings:
  • /usr/dict/words