Technical Information
Malicious functions:
Gains root privileges
Launches processes:
- sh -c cp /usr/bin/chsh /tmp/bak
- cp /usr/bin/chsh /tmp/bak
- sh -c /usr/bin/chsh
- /usr/bin/chsh
- /bin/sh -c /bin/cp /tmp/bak /usr/bin/chsh&&/bin/rm -f /tmp/bak;/bin/sh -i
- /bin/cp /tmp/bak /usr/bin/chsh
- /bin/rm -f /tmp/bak
- /bin/sh -i
Performs operations with the file system:
Creates or modifies files:
- /tmp/bak
- /proc/704/mem
- /usr/bin/chsh
Deletes files:
- /tmp/bak"
Other:
Collects CPU information