Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/cron.d/vim.run.log
Malicious functions:
Removes itself
Launches itself as a daemon
Performs operations with the file system:
Modifies file access rights:
- /var/.syslog
- /etc/cron.d/vim.run.log
- /var/spool/cron/root
Creates or modifies files:
- /var/tmp/.vim.log
- /var/.syslog
- /var/spool/cron/root
Deletes files:
- /var/.syslog
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:35495
HTTP GET requests:
- lo####.###ectionapis.com/loader.gif
DNS ASK:
- lo####.#onectionapis.com