[tWiCe]

Malware family created by ChinaZ actor.
Trojan is being installed by compromised SSH access. Originally file is located on HFS and downloaded to target system via script or command.

Trojan is designed for routers and known to be compiled only for ARM and MIPS archs. Overall view of code reminds me MrBlack family.

Commands list includes HTTP Flood, SYN Flood, DNS Flood and stop attack.

This trojan has been spotted in-the-wild on compromised router.

#1
bot version: 20150412
C&C: 216.99.151.186
https://www.virustotal.com/ru/file/f0e7 ... /analysis/

#2
bot version: 20150412
C&C:222.186.21.82
https://www.virustotal.com/ru/file/4477 ... /analysis/

@unixfreaxjp samples include debug info, so you can take list of source files for your collection ;)

[malwarelabs]

I like how Kaspersky kyrspeasK made his signature Linux.Kluh.a for DDoS.Linux.hulk.a / Linux.Znaich.a for Linux.chinaZ.a

[unixfreaxjp]

@unixfreaxjp samples include debug info, so you can take list of source files for your collection ;)

Thank's so much! :) collected. Typical Chinaz..testing many things..but can't build elf properly. I humbly take every advantages from this for my skeleton :D

I like how Kaspersky kyrspeasK made his signature Linux.Kluh.a for DDoS.Linux.hulk.a / Linux.Znaich.a for Linux.chinaZ.a

"kysrepsak"<

Just checked and I think this is the thread when was first time detected:
https://twitter.com/wirehack7/status/590194047840555008

VT: https://www.virustotal.com/en/file/354f ... /analysis/
I wasn't around when this was found. Anyone has the installer script? For collection :D

[r3dbU7z]

H! a11
Probably this information is useful to someone (I hope)

HFS h00p://23.251.57.95:655

[unixfreaxjp]

H! a11
Probably this information is useful to someone (I hope)

Hi @r3dbU7z it is very useful, Sir. Thank you. I can't fetch the sample since it looks down, would you please kindly share us in the attacment with usual passworded archive? with thank you in advance! regards.

[r3dbU7z]

I can't fetch the sample since it looks down, would you please kindly share us in the attacment with usual passworded archive?

It's my fail. I'm sorry.