ShellBot Malware Being Distributed to Linux SSH Servers
Mar 13 2023
AhnLab Security Emergency response Center (ASEC)
https://asec.ahnlab.com/en/49769/
| Notes |
|---|
| ShellBot aka PerlBot |
| Linux malware |
| SSH |
| DDoS |
| IRC |
| command and control |
| Perl |
| – list of credentials as IoCs |
| scans for port 22 |
| LiGhT’s Modded perlbot v2 |
| – list of IP addresses of IRC servers |
| – list of channel names |
| TCP, UDP, HTTP flooding |
| DDoS PBot v2.0 |
| – installer command one-liners |
| PowerBots (C) GohacK |
| – list of bot admin nicknames |
| reverse shell |
| – hash and URL IoCs |