Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
- /etc/init.d/durex
Creates or modifies the following symlinks:
- /etc/rc0.d/K01durex
- /etc/rc1.d/K01durex
- /etc/rc2.d/S02durex
- /etc/rc3.d/S02durex
- /etc/rc4.d/S02durex
- /etc/rc5.d/S02durex
- /etc/rc6.d/K01durex
Malicious functions:
Launches itself as a daemon
Manages services:
- update-rc.d -f durex remove
- systemctl daemon-reload
- update-rc.d durex defaults
- update-rc.d durex enable
Launches processes:
- sh -c chmod 777 /usr/sbin/Durex
- chmod 777 /usr/sbin/Durex
- sh -c /usr/sbin/Durex
- /usr/sbin/Durex
- sh -c xxd -r -p /usr/local/lib/durex.so /usr/local/lib/durex.so
- xxd -r -p /usr/local/lib/durex.so /usr/local/lib/durex.so
- sh -c update-rc.d -f durex remove
- /sbin/insserv -f
- sh -c chmod +x /etc/init.d/durex
- chmod +x /etc/init.d/durex
- sh -c update-rc.d durex defaults
- /sbin/insserv durex
- sh -c update-rc.d durex enable
Performs operations with the file system:
Modifies file access rights:
- /usr/sbin/Durex
- /etc/init.d/durex
Creates or modifies files:
- /usr/sbin/Durex
- /usr/local/lib/durex.so
- /etc/ld.so.preload
Deletes files:
- /usr/sbin/Durex
- /usr/local/lib/durex.so
- /etc/ld.so.preload
- /etc/init.d/durex
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:3001
