Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.d/init.d/tcp4
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- systemd
Replaces the following system files:
- /usr/bin/grep
- /usr/bin/wget
Manages services:
- ['systemctl', 'daemon-reload', 'redis.service']
- ['systemctl', 'enable ', 'redis.service']
- ['systemctl', 'daemon-reload', 'mysql.service']
- ['systemctl', 'enable ', 'mysql.service']
Launches processes:
- uname -r
- uname -m
- <SAMPLE_FULL_PATH> e
- <SAMPLE_FULL_PATH> d
- mount -o bind /var /proc/726/
- crontab /var/.recovery
Kills the following processes:
- khugepaged
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.H3gTvy
Creates folders:
- /var/web
Creates or modifies files:
- /usr/bin/.kill
- /usr/bin/kill
- /etc/default_dns.conf
- /tmp/.system
- /dev/watchdog
- /opt/cgo
- /var/web/media.jpg
- /usr/lib/readdir.so
- /var/spool/cron/crontabs/tmp.H3gTvy
- /etc/systemd/system/redis.service
- /usr/bin/.ls
- /usr/bin/ls
- /etc/systemd/system/mysql.service
- /usr/bin/.pwd
- /usr/bin/pwd
- /usr/bin/.mkdir
- /usr/bin/mkdir
- /usr/bin/.rm
- /usr/bin/rm
- /usr/bin/.cat
- /usr/bin/cat
- /usr/bin/.grep
- /usr/bin/.chmod
- /usr/bin/chmod
- /usr/bin/.chown
- /usr/bin/chown
- /usr/bin/.sudo
- /usr/bin/sudo
- /usr/bin/.top
- /usr/bin/top
- /usr/bin/.tar
- /usr/bin/tar
- /usr/bin/.find
- /usr/bin/find
- /usr/bin/.ssh
- /usr/bin/ssh
- /usr/bin/.wget
- /usr/bin/.df
- /usr/bin/df
- /usr/bin/.head
- /usr/bin/head
- /usr/bin/.tail
- /usr/bin/tail
- /usr/bin/.awk
- /usr/bin/mawk
- /usr/bin/.sed
- /usr/bin/sed
- /usr/bin/.echo
- /usr/bin/echo
- /usr/bin/.man
- /usr/bin/man
- /usr/bin/.ln
- /usr/bin/ln
- /usr/bin/.wc
- /usr/bin/wc
Mounts file systems:
- /var
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:7898
Establishes connection:
- 8.#.8.8:53
- 15#.#.235.76:55655
Sends data to the following servers:
- 8.#.8.8:53
Receives data from the following servers:
- 8.#.8.8:53
