Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.DnsAmp.1

Added to the Dr.Web virus database: 2014-04-21

Virus description added:

A group of Linux Trojans designed to carry out DDoS attacks. These Trojans can infect 32-bit (Linux.DnsAmp.1) and 64-bit (Linux.DnsAmp.2) versions of Linux.

Once this Trojan is launched, it automatically registers itself in the OS autorun list by modifying the etc/rc.d/rc.local file. Then the Trojan creates two threads. Though each of these threads executes the same actions, they employ different command and control servers for their work.

Once the connection to the command and control server is established, the Trojan starts gathering information about the infected system. This information can include the following data:

  • OS name and version
  • Free memory and Swap cache space
  • CPU frequency
  • Data from the dosset.dtdb file (the data is written in the file after a corresponding command is received from the command and control server)

The data acquired by the Trojan is forwarded to the remote command and control server. Then the malware awaits further commands. If the Trojan cannot receive a command, it gathers additional information and sends it to the command and control server.

Depending on the command key value (DWORD values at zero offset), the malicious program can execute the following actions:

KeyCommand
0x99Set the flag of the DDoS attack’s beginning to zero.
0x4DESave the command data to the dosset.dtdb file.
0x88Ignore the command.
Other options if
key < 0x5DD
If the flag of the DDoS attack’s beginning is set to zero, launch the attack.
0x5DDRestart execution of actions once the command and control server address is determined
(key > 0x5DD) && (key != 0xFF1)
&& (key != 0x99999) && (key != 0x6AF)Update itself.
0xFF1Terminate the work.

The Trojan can update itself once the corresponding command is received from the server. During update, the killall <module name> command is called. As a result, the module is deleted and the wget utility is run—with its help, the updated module is downloaded to the /home directory. If the download is successful, the file becomes executable (chmod +x). Next, the downloaded file is launched.

A DDoS attack command looks as follows:

OffsetMeaning
76Victim’s IP or domain (C string)
48Number of threads used for the attack
40Attack type

Trojans belonging to this group can launch the following attacks:

  • SYN Flood (repetitive sending of a specially generated package to the attacked host until the host stops responding)
  • UDP Flood (after establishing a connection to the attacked host over the UDP protocol, the Trojan attempts to send the victim 1,000 messages)
  • Ping Flood (an echo request with the process PID as an identifier is generated over the ICMP protocol (data is the HEX value 0xA1B0A1B0))
  • Sending requests to DNS servers (DNS Amplification)
  • Sending requests to NTP servers (NTP Amplification—implemented, but not used, in older versions of these Trojans)

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2021

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124