SHA1:
- e43fd0752b8c03ffae628a6b83e2a03944f11f4e
A backdoor for Linux operating systems. It was detected in the libz library. During its operation, the Trojan intercepts calling of the following system functions: __libc_start_main, sscanf, __syslog_chk, fopen, and fgets. It is initialized in __libc_start_main; the main code is located in the sscanf function. It operates only with binary files that ensure data transfers via the SSH protocol. It fails to operate if the launched file name is the same as /usr/sbin/sshds. For external connection, it doesn’t use a currently open socket. Instead it uses the first open socket out of 1,024. After this, the socket is moved to the zero descriptor, and the remaining 1,023 are shut down.
The connection protocol is encrypted using the RC4 algorithm; strings are also encrypted. The backdoor can execute the following commands:
| Command | Action | Arguments |
|---|---|---|
| exec | Run a binary file | File name |
| tcp | Connect to host:port | host, port |
| up | Download a file | File name |
