Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.d/httpsd
- /etc/crontab
- /etc/rc.local
Malicious functions:
Launches processes:
- sh -c crontab -r > /dev/null 2>&1
- sh -c (echo \"0 */6 * * * /tmp/.httpsd\") | crontab - >/dev/null 2>&1
- sh -c cat /proc/cpuinfo |grep processor|wc -l
- crontab -r
- crontab -
- grep processor
- cat /proc/cpuinfo
- wc -l
Performs operations with the file system:
Modifies file access rights:
- /bin/.httpsd
- /tmp/.httpsd
- /tmp/.httpspid
- /tmp/.httpskey
- /var/spool/cron/crontabs/tmp.1hSMnT
Deletes folders:
- <SAMPLE_FULL_PATH>"
Creates or modifies files:
- /bin/.httpsd
- /tmp/.httpsd
- /tmp/.httpspid
- /tmp/.httpskey
- /var/spool/cron"/crontabs/tmp.1hSMnT
- /var/spool/cron/crontabs/tmp.1hSMnT
Deletes files:
- <SAMPLE_FULL_PATH>"
Network activity:
HTTP POST requests:
- 14#.###.66.143:80/api
DNS ASK:
- k.####ctionapis.com
Other:
Collects CPU information