Technical Information
Malicious functions:
Removes itself
Manages services:
- systemctl enable fsopen.service
Launches processes:
- sh -c mount -o remoun
- mount -o remoun
- sh -c which semanage 2> /dev/null
- which semanage
- sh -c systemctl enable fsopen.service 2>/dev/null
- sh -c /usr/bin/fsopen 0 &
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/fsopen
- /lib/systemd/system/fsopen.service
Creates or modifies files:
- /usr/bin/fsopen
- /lib/systemd/system/fsopen.service
Mounts file systems:
- /root/(null)