Technical Information
Malicious functions:
Removes itself
Launches processes:
- sh -c rm -rf /root/*
- rm -rf <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log
Performs operations with the file system:
Creates or modifies files:
- /root/stdout.log (deleted)
Deletes files:
- /root/run.sh
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- http://###.##.78.125/sbw.php
DNS ASK:
- sq.##pnml.cn