Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/crontab
Malicious functions:
Launches itself as a daemon
Manages services:
- /sbin/service crond start
Launches processes:
- sh -c ulimit -HSn 65536
Performs operations with the file system:
Creates or modifies files:
- /etc/sysctl.conf
- /etc/security/limits.conf
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:15898
Establishes connection:
- 12#.###.179.189:50208
DNS ASK:
- qf##20.top
Other:
Collects information about network activity
