Technical Information
Malicious functions:
Replaces the following system files:
- /usr/bin/curl
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- sleep 3
- mv /usr/bin/curl /usr/bin/JK
- cat
- chmod 777 /usr/bin/curl /usr/bin/JK
- sleep 5
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/curl
Creates or modifies files:
- /tmp/sh-thd-814704947
Deletes files:
- /tmp/sh-thd-814704947
Other:
Collects RAM information