Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- bpymnttn
- [kthrtld]
- crdsle
Launches processes:
- sh -c /tmp/nveyqobx brnwev &
- /tmp/nveyqobx brnwev
- sh -c /tmp/xteldtql &
- /tmp/xteldtql
- sh -c /tmp/wyrgffym crdsle &
- /tmp/wyrgffym crdsle
Kills system processes:
- sshd
Kills the following processes:
- run.sh
- bash
- (sd-pam)
- systemd
- cron
- rpc.idmapd
- rpcbind
- dhclient
- systemd-udevd
- systemd-journal
- kworker/u2:0
- systemd-cgroups
Performs operations with the file system:
Modifies file access rights:
- /tmp/nveyqobx
- /tmp/xteldtql
- /tmp/wyrgffym
Creates or modifies files:
- /tmp/wrw
- /tmp/nveyqobx
- /tmp/xteldtql
- /tmp/.tmp
- /tmp/wyrgffym
Deletes files:
- /tmp/nveyqobx
- /tmp/xteldtql
- /tmp/wyrgffym
Locks files:
- /tmp/wrw
- /tmp/.tmp
Network activity:
Establishes connection:
- 95.###.153.229:7777
HTTP GET requests:
- 18#.##5.169.6/d/sss
- 18#.###.169.6/d/lmmml
Sends data to the following servers:
- 95.###.153.229:7777
Receives data from the following servers:
- 95.###.153.229:7777