Technical Information
Malicious functions:
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Modifies firewall settings:
- /usr/sbin/iptables -A OUTPUT -m set --match-set block src -j DROP
- /usr/sbin/iptables -A OUTPUT -m set --match-set block dst -j DROP
- /usr/sbin/iptables -I INPUT -m set --match-set block src -j DROP
- /usr/sbin/iptables -I INPUT -m set --match-set block dst -j DROP
- /usr/sbin/iptables -A INPUT -m set --match-set block src -j DROP
- /usr/sbin/iptables -A INPUT -m set --match-set block dst -j DROP
- /usr/sbin/iptables -I OUTPUT -m set --match-set block src -j DROP
- /usr/sbin/iptables -I OUTPUT -m set --match-set block dst -j DROP
- /usr/sbin/iptables -A OUTPUT -m set --match-set block src -j REJECT
- /usr/sbin/iptables -A OUTPUT -m set --match-set block dst -j REJECT
- /usr/sbin/iptables -I INPUT -m set --match-set block src -j REJECT
- /usr/sbin/iptables -I INPUT -m set --match-set block dst -j REJECT
- /usr/sbin/iptables -A INPUT -m set --match-set block src -j REJECT
- /usr/sbin/iptables -A INPUT -m set --match-set block dst -j REJECT
- /usr/sbin/iptables -I OUTPUT -m set --match-set block src -j REJECT
- /usr/sbin/iptables -I OUTPUT -m set --match-set block dst -j REJECT
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- /usr/sbin/ipset create block hash:net
- wget http://srv62.com/block.txt -O /tmp/block.txt
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
- /tmp/block.txt
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 10#.##1.51.40:80
DNS ASK:
- sr##2.com
Other:
Collects RAM information
