Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dpkg-deb-package
Malicious functions:
Substitutes application name for:
- (sysv-install)
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'dpkg-deb-package.service']
Launches processes:
- sed -e s/$//
- hostname
- chattr +ia /etc/init.d/dpkg-deb-package
- lsof -t -i :444
- head -n 1
- /usr/bin/mawk awk {print \x22-\x22$2}
- grep -v grep
- id -u
- <0x199>
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- pgrep -f klibsystem4
- bash -c ufw disable
- pgrep -f sysrv
- ps x
- /bin/sh /lib/systemd/systemd-sysv-install enable dpkg-deb-package
- sed -e s/^ *//
- rm -rf -- dpkg-deb-package
- /bin/bash /etc/init.d/dpkg-deb-package start
- hostname -I
- cat /etc/ssh/sshd_config
- ps -A -ostat,ppid
- nohup ./dpkg-deb-package
- whoami
- /usr/bin/mawk awk {print $1}
- grep Port
- pgrep -f klibsystem5
- grep -m 1 model name /proc/cpuinfo
- cut -d: -f2
- chattr +ia /etc/systemd/system/dpkg-deb-package.service
- grep /etc/cron
- lsof -t -i :59475
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- /tmp/-bash-346c12cf-157f-4c2f-bb9c-02d3e0a82f67 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
- grep -c ^processor /proc/cpuinfo
- cp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/dpkg-deb-package
Creates or modifies files:
- /tmp/-bash-346c12cf-157f-4c2f-bb9c-02d3e0a82f67
- /etc/systemd/system/dpkg-deb-package.service
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:10444
Other:
Collects OS information
Collects CPU information
Collects RAM information
