SHA1:
- 665346a64bee0ff2a52f004855d389433b4f0ce9 (6th version)
- 84f7c64940e80a11b075b256ebba8e9c0d5b90e0 (7th version)
- 7f27cfb76644b606959486f40cf4c4d8810e6977 (8th version)
- 8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19 (9th version)
- 2c99068a37e59c1bfbb7c0f8a95952b35031267d (10th version)
Improved versions of Linux.BackDoor.Xudp.1 that have the following differences:
- Instead of transfer.php, the link.php file is requested.
- The Trojan is saved as /lib/sock.
- The Trojan sends the following information in Http_thread:
- number of kernels;
- memory;
- the uname-a value;
- contents of /etc/issue.
In the 8th version (7f27cfb76644b606959486f40cf4c4d8810e6977), the RUN function is replaced with the SYSTEMEXIT function. When it is executed, popen is called, the output is sent to the server, and the backdoor then terminates itself. Also, the TCP_Flood function is modified.
The 9th version (8f4ad9f9c9bb6bf0d9e533f56f5cc13682b37c19) is detected as Linux.BackDoor.Xudp.3. In comparison with Linux.BackDoor.Xudp.1, it can carry out the Dns Amplification attack.