Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/tyolzomgal
- /etc/cron.hourly/gcc4.sh
- /etc/crontab
Creates or modifies the following symlinks:
- /etc/rc1.d/S90tyolzomgal"
- /etc/rc2.d/S90tyolzomgal"
- /etc/rc3.d/S90tyolzomgal"
- /etc/rc4.d/S90tyolzomgal"
- /etc/rc5.d/S90tyolzomgal"
Malicious functions:
Launches itself as a daemon
Manages services:
- update-rc.d tyolzomgal defaults
Launches processes:
- /usr/bin/tyolzomgal
- chkconfig --add tyolzomgal
- sh -c sed -i '/\/etc\/cron.hourly\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab
- sed -i /\/etc\/cron.hourly\/gcc4.sh/d /etc/crontab
- /usr/bin/gxzyjpcdrs gnome-terminal 689
- /usr/bin/gxzyjpcdrs echo \"find\" 689
- /usr/bin/gxzyjpcdrs pwd 689
- /usr/bin/gxzyjpcdrs ls -la 689
- /usr/bin/gxzyjpcdrs sleep 1 689
- /sbin/insserv tyolzomgal
Performs operations with the file system:
Modifies file access rights:
- /etc/sednRrTCH
Creates or modifies files:
- /lib/libudev4.so
- /usr/bin/tyolzomgal
- /etc/sednRrTCH
- /var/run/gcc4.pid
- /run/gcc4.pid
- /usr/bin/gxzyjpcdrs
Deletes files:
- /etc/rc1.d/S90tyolzomgal"
- /etc/rc2.d/S90tyolzomgal"
- /etc/rc3.d/S90tyolzomgal"
- /etc/rc4.d/S90tyolzomgal"
- /etc/rc5.d/S90tyolzomgal"
- /etc/rc.d/rc1.d/S90tyolzomgal"
- /etc/rc.d/rc2.d/S90tyolzomgal"
- /etc/rc.d/rc3.d/S90tyolzomgal"
- /etc/rc.d/rc4.d/S90tyolzomgal"
- /etc/rc.d/rc5.d/S90tyolzomgal"
- <SAMPLE_FULL_PATH>"
- /usr/bin/gxzyjpcdrs"
Network activity:
Establishes connection:
- 0.0.0.0:65520
- 0.0.0.0:60000
DNS ASK:
- la##.###############ewflbxvcuagfkxncvzxbbcnvzdwijhfalefhawhfawfvbxse.org
Other:
Collects information about network activity