UNIX_DNSCHAN.A

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview

This is a malicious Bash script that arrives as a dropped file of OSX_DNSCHAN.A. When executed, it modifies the affected system's Domain Name System (DNS) server settings to certain IP addresses.

The DNS is responsible for translating domain names into IP addresses. Modifying its setttings, along with the system's Internet settings, allows the infected system to connect to possibly malicious Web sites.

Related Items