Skip to content
MalwareWiki

Malware

PITSOCK

According to Mandiant, this is backdoor which hooks the accept and setsockopt of the web process by modifying its procedure linkage table (PLT).

PITSOCK is a Linux malware family.

Background

Per Mandiant, this backdoor tampers with the web process's procedure linkage table (PLT) to hook its accept and setsockopt calls. Once a particular 48-byte magic byte sequence arrives in the inbound buffer, it opens a backdoor channel over the Unix socket /tmp/clientsDownload.sock.

Source: Malpedia (Fraunhofer FKIE).