Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/setenvi
Creates or modifies the following symlinks:
- /etc/rc2.d/S20setenvi
- /etc/rc3.d/S20setenvi
- /etc/rc4.d/S20setenvi
- /etc/rc5.d/S20setenvi
Malicious functions:
Launches processes:
- sh -c mount -o remoun
- mount -o remoun
- sh -c /usr/bin/setenvi 0 &
- /usr/bin/setenvi 0
- sh -c id 2>/dev/null
- id
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/setenvi
- /etc/init.d/setenvi
Deletes folders:
- <SAMPLE_FULL_PATH>
Creates symlinks:
- /etc/rcS.d/S20setenvi
Creates or modifies files:
- /usr/bin/setenvi
- /var/tmp/.szYgDfgLj
- /etc/.YqfoeUBtg
Deletes files:
- <SAMPLE_FULL_PATH>
Mounts file systems:
- /root/(null)