Technical Information
Malicious functions:
Substitutes application name for:
- httpd
Modifies firewall settings:
- iptables -D INPUT -p tcp --dport 23 -j DROP
Operates the following engine modules:
- err
Launches processes:
- /bin/sh -c insmod /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_tables.ko
- uname -r
- insmod /lib/modules/3.16.0-4-686-pae/kernel/net/ipv4/netfilter/ip_tables.ko
- /bin/sh -c insmod /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/iptable_filter.ko
- insmod /lib/modules/3.16.0-4-686-pae/kernel/net/ipv4/netfilter/iptable_filter.ko
- /bin/sh -c iptables -D INPUT -p tcp --dport 23 -j DROP