Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/cron.d/vim.run.log
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Performs operations with the file system:
Modifies file access rights:
- /var/.syslog
- /etc/cron.d/vim.run.log
Creates or modifies files:
- /var/tmp/.vim.log
- /var/.syslog
- /var/spool/cron/root
Deletes files:
- /var/.syslog
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:22446
HTTP GET requests:
- ww#.######9.com/weixin/loader.gif
DNS ASK:
- ww#.#tj4949.com