Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- sh -c history -c; history -w
- sh -c rm -rf ~/.bash_history ~/* /var/lib/tftpboot/* /var/tftp/* /tmp/*
- rm -rf /root/.bash_history <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log /var/lib/tftpboot/* /var/tftp/* /tmp/*
Performs operations with the file system:
Deletes files:
- /root/.bash_history
- /root/run.sh
- /var/lib/tftpboot/*
- /var/tftp/*
- /tmp/*
Network activity:
Establishes connection:
- 8.#.8.8:53
- 68.###.119.204:738
Sends data to the following servers:
- 68.###.119.204:738
Receives data from the following servers:
- 68.###.119.204:738