Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/OLicenseServer
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc3.d/S01OLicenseServer
- /etc/rc5.d/S01OLicenseServer
Malicious functions:
Performs process tracing:
- <SAMPLE>
Manages services:
- /usr/sbin/update-rc.d OLicenseServer defaults 77
- systemctl daemon-reload
Launches processes:
- /sbin/insserv OLicenseServer
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/OLicenseServer
Creates or modifies files:
- /var/tmp/OptimumService-OLicenseServer
- /root/server.pid
- /root/OLicenseServerDB.odx
- /root/OLicenseServerDB.ini
- /root/OLicenseServerDB.odb
- /root/OL201708.log
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:80