Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/wake
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K01wake
- /etc/rc1.d/K01wake
- /etc/rc2.d/S01wake
- /etc/rc3.d/S01wake
- /etc/rc4.d/S01wake
- /etc/rc5.d/S01wake
- /etc/rc6.d/K01wake
Malicious functions:
Gains root privileges
Substitutes application name for:
Manages services:
- update-rc.d wake defaults 99
- systemctl daemon-reload
Launches processes:
- sh -c ulimit -n 3000
- sh -c update-rc.d wake defaults 99
- /sbin/insserv wake
- sh -c chkconfig --add wake
- sh -c chkconfig wake on
- sh -c nohup /usr/bin/wake -c 1 &
- nohup /usr/bin/wake -c 1
- /usr/bin/wake -c 1
- grep :39999
- netstat -nlp
- sh -c uname -a
- uname -a
- sleep 600
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/wake
- /etc/init.d/wake
Creates or modifies files:
- /usr/bin/wake
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:39999
Establishes connection:
- <LOCAL_DNS_SERVER>
- 0.0.0.0:6969
DNS ASK:
- to#.##ngji1688.com
Other:
Collects CPU information