Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.d/syslog
- /etc/crontab
- /etc/rc.local
Malicious functions:
Launches processes:
- sh -c ps -ef | grep stratum+tcp | awk '{print $2}' | xargs kill -9 >/dev/null 2>&1
- grep stratum+tcp
- ps -ef
- awk {print $2}
- xargs kill -9
- kill -9 685 687
Kills the following processes:
- <SAMPLE>
- /bin/grep
Performs operations with the file system:
Modifies file access rights:
- /tmp/.syspid
- /bin/.syslog
Creates or modifies files:
- /tmp/.syspid
- <SAMPLE_FULL_PATH>
Deletes files:
- <SAMPLE_FULL_PATH>"
Network activity:
Establishes connection:
- 14#.###.14.109:13333
DNS ASK:
- et######ast1.nanopool.org
Sends data to the following servers:
- 14#.###.14.109:13333
Receives data from the following servers:
- 14#.###.14.109:13333
Other:
Collects CPU information
Collects RAM information
Collects information about network activity