Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rek
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K02urandom
- /etc/rc0.d/K01rek
- /etc/rc1.d/K01rek
- /etc/rc2.d/S02rek
- /etc/rc3.d/S02rek
- /etc/rc4.d/S02rek
- /etc/rc5.d/S02rek
- /etc/rc6.d/K02urandom
- /etc/rc6.d/K01rek
Malicious functions:
Substitutes application name for:
- 68114813433227u2
Manages services:
- update-rc.d rek defaults
- systemctl daemon-reload
Launches processes:
- sh -c mv yama.* /etc; mv /etc/yama.* /etc/ocd; echo -e '#!/bin/bas
- mv yama.* /etc
- mv /etc/yama.* /etc/ocd
- chmod +x /etc/init.d/rek
- /sbin/insserv rek
- rm -rf .bash_history
- rm -rf /root/.bash_history
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/rek
Deletes files:
- /etc/rc0.d/K01urandom
- /etc/rc6.d/K01urandom
- /root/.bash_history
Network activity:
Establishes connection:
- 8.#.8.8:53
