Technical Information
Malicious functions:
Removes itself
Manages services:
- systemctl enable unix_upstart.service
Launches processes:
- sh -c mount -o remoun
- mount -o remoun
- sh -c which semanage 2> /dev/null
- which semanage
- sh -c systemctl enable unix_upstart.service 2>/dev/null
- sh -c /usr/bin/unix_upstart 0 &
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/unix_upstart
- /lib/systemd/system/unix_upstart.service
Creates or modifies files:
- /usr/bin/unix_upstart
- /lib/systemd/system/unix_upstart.service
Mounts file systems:
- /root/(null)