Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /bin/.vim.bin
Deletes folders:
- <SAMPLE_FULL_PATH>"
Creates or modifies files:
- /bin/.vim.bin
- /tmp/.vim.log
Deletes files:
- <SAMPLE_FULL_PATH>"
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP POST requests:
- http://###.##6.238.137/api
DNS ASK:
- st####.#onectionapis.com