Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/samba
Creates or modifies the following symlinks:
- /etc/rc3.d/S99samba
Malicious functions:
Launches processes:
- <SAMPLE_FULL_PATH> postgresql-auto-update
- /root/linux-gnu system-update
Performs operations with the file system:
Creates folders:
- /tmp/seconfig
- /etc/seconfig
Creates or modifies files:
- /root/linux-gnu
- <SAMPLE_FULL_PATH>
- /tmp/seconfig/z.sh
Deletes files:
- /var/log/utmp
- /var/log/wtmp
- /var/log/lastlog
- /var/log/secure
- /root/linux-gnu
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:47292
- 127.0.0.1:37373
Establishes connection:
- 10#.##3.83.23:27
HTTP GET requests:
- 10#.###.#2.32/xorgg_linux_amd64
Receives data from the following servers:
- 10#.##3.83.23:27
- 10#.##3.82.32:80