Linux/Remaiten [Threat Name]

Detection created

2016-03-01

Linux/Remaiten serves as a backdoor. It can be controlled remotely. It is able to spread according to instructions downloaded from the Internet.

The trojan does not create any copies of itself.

The trojan may create the following files:

It is able to spread according to instructions downloaded from the Internet.

The trojan generates various IP addresses.

It tries to connect to the remote machine on port:

The trojan attempts to bruteforce login credentials.

If the trojan is succesful, it attempts to send the file/malware component to the remote computer.

The trojan usually contains within the main malware body another malware files.

The file is saved to one of the following folders:

Its filename may be one of the following:

A string with variable content is used instead of %variable% .

The file is then executed.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of IP/URL addresses. The IRC, HTTP, Telnet protocol is used in the communication.

It can execute the following operations:

The trojan can rename its process name.

For further information follow the links below: