Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rcS
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c ps
- ps
- sh -c chmod 777 /etc/init.d/rcS
- chmod 777 /etc/init.d/rcS
- sh -c (chmod -R 777 /tmp) ; (rm -f /tmp/.gns*) ; (echo yes|cp -p <SAMPLE_FULL_PATH> /tmp/.gns1521422354)
- chmod -R 777 /tmp
- rm -f /tmp/.gns*
- cp -p <SAMPLE_FULL_PATH> /tmp/.gns1521422354
- sh -c (chmod +x /tmp/.gns1521422354) ; (setsid /tmp/.gns1521422354 &)
- chmod +x /tmp/.gns1521422354
- setsid /tmp/.gns1521422354
- /tmp/.gns1521422354
- sh -c /etc/init.d/ebtables stop > /dev/null
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/rcS
- /tmp
- /tmp/.font-unix
- /tmp/.ICE-unix
- /tmp/.XIM-unix
- /tmp/.X11-unix
- /tmp/.Test-unix
- /tmp/.gns1521422354
Creates or modifies files:
- /tmp/.gns1521422354
Deletes files:
- /tmp/.gns*"
Other:
Collects CPU information
Collects RAM information