| Port No | 3128 |
| Service Name | REVTUNNEL |
| RFC Doc | 0 |
| Protocol | TCP |
| Description | This memory-resident, Perl script backdoor tool allows a malicious user to modify any of the following configuration settings: HTTP Mode (Get/Post) Port to listen to Server Shell Delay Time Time Daily It can either act as a master or a slave, depending on the parameters used. As a slave, its sole purpose is to connect to its master, and to wait for and execute commands. As a master, on the other hand, it listens to a hardcoded port 16386, which can be modified manually. This backdoor tool runs on Unix and is written in Perl. |
| Reference Link | REVTUNNEL |
| Attack | Solution: This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier. Login to the console using a valid username and password Use ps command to list running processes in memory In the list of running programs*, locate the malware file or files detected earlier and take note of their process IDs. Using the kill command, terminate all process related to the malware detected earlier using the process IDs. Example: kill 2122 Note: 2122 is only a sample process ID for the malware |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.