||This article includes a list of references, related reading or external links, but its sources remain unclear because it lacks inline citations. (March 2010) (Learn how and when to remove this template message)|
This worm, once the host has been compromised, downloads and executes a shell script from a web server. This script downloads a gzipped executable file named k.gz from the same address, and then decompresses and runs the file.
This downloaded file appears to be an IRC client. It connects to different channels and waits for commands to process on the infected host.
Then the worm checks for presence of the GCC compiler on the local system and, if found, creates a directory called .socket2. Next, it downloads a compressed file called devnull.tgz. After decompressing, two files are created: an ELF binary file called devnull and a source script file called sslx.c. The latter gets compiled into the ELF binary sslx.
The executable will scan for vulnerable hosts and use the compiled program to exploit a known OpenSSL vulnerability.
|This malware-related article is a stub. You can help Wikipedia by expanding it.|