ELF_BASHWOOP.SM

This malware is involved in the Bash Vulnerability Exploit attack of September 2014. It is capable of compromising an affected system's security by carrying out commands made by a malicious remote user.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• kill
• udp
• syn
• tcpamp
• dildos
• http
• mineloris

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.150.154:9003