Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.d/syslog
- /etc/crontab
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c ps -ef | grep stratum+tcp | awk '{print $2}' | xargs kill -9 >/dev/null 2>&1
- ps -ef
- grep stratum+tcp
- awk {print $2}
- xargs kill -9
- kill -9 688 690
Kills the following processes:
- <SAMPLE>
- /bin/grep
Performs operations with the file system:
Modifies file access rights:
- /tmp/.syspid
- /bin/.syslog
Creates or modifies files:
- /tmp/.syspid
- <SAMPLE_FULL_PATH>
Deletes files:
- <SAMPLE_FULL_PATH>"
Network activity:
Establishes connection:
- 94.##.212.204:4444
DNS ASK:
- po##.#inexmr.com
Sends data to the following servers:
- 94.##.212.204:4444
Receives data from the following servers:
- 94.##.212.204:4444
Other:
Collects CPU information
Collects RAM information
Collects information about network activity