Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- /root/.sess <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- /root/.sess
Creates or modifies files:
- /root/.sess
- /var/run/crond.pid
Deletes files:
- /root/.sess"
Locks files:
- /run/crond.pid