SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.roboto (Back to overview)

Roboto

P2P Botnet discovered by Netlab360. The botnet infects linux servers via the Webmin RCE vulnerability (CVE-2019-15107) which allows attackers to run malicious code with root privileges and take over older Webmin versions. Based on the Netlabs360 analysis, the botnet serves mainly 7 functions: reverse shell, self-uninstall, gather process' network information, gather Bot information, execute system commands, run encrypted files specified in URLs and four DDoS attack methods: ICMP Flood, HTTP Flood, TCP Flood, and UDP Flood.

References
2019-11-20 ⋅ 360 netlab ⋅ Alex Turing, GenShen Ye
@online{turing:20191120:awaiting:eefead1, author = {Alex Turing and GenShen Ye}, title = {{The awaiting Roboto Botnet}}, date = {2019-11-20}, organization = {360 netlab}, url = {https://blog.netlab.360.com/the-awaiting-roboto-botnet-en}, language = {English}, urldate = {2020-01-10} } The awaiting Roboto Botnet
Roboto
2019-11-20 ⋅ ZDNet ⋅ Catalin Cimpanu
@online{cimpanu:20191120:new:f9c81de, author = {Catalin Cimpanu}, title = {{New Roboto botnet emerges targeting Linux servers running Webmin}}, date = {2019-11-20}, organization = {ZDNet}, url = {https://www.zdnet.com/article/new-roboto-botnet-emerges-targeting-linux-servers-running-webmin}, language = {English}, urldate = {2019-12-17} } New Roboto botnet emerges targeting Linux servers running Webmin
Roboto

There is no Yara-Signature yet.