Technical Information
Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
- iptables -F
- /sbin/iptables -F
- /sbin/iptables -X
Manages services:
- service iptables stop
- systemctl stop iptables.service
- service firewalld stop
- systemctl stop firewalld.service
Launches processes:
- sh -c rm -rf /tmp/* /var/tmp/* /tmp/.* /var/tmp/.*
- rm -rf /tmp/* /var/tmp/* /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix /var/tmp/. /var/tmp/..
- sh -c rm -rf /var/log/wtmp
- rm -rf /var/log/wtmp
- sh -c rm -rf /bin/netstat
- rm -rf /bin/netstat
- sh -c iptables -F
- sh -c pkill -9 perl
- pkill -9 perl
- sh -c pkill -9 python
- pkill -9 python
- sh -c service iptables stop
- sh -c /sbin/iptables -F; /sbin/iptables -X
- sh -c service firewalld stop
- sh -c rm -rf ~/.bash_history
- rm -rf /root/.bash_history
- sh -c history -c;history -w
- sh -c rm -rf /var/log/lastlog; history -c
- rm -rf /var/log/lastlog
- sh -c pkill -9 1
- pkill -9 1
- sh -c pkill -9 \"1\"
- sh -c pkill -9 10
- pkill -9 10
- sh -c pkill -9 \"10\"
- sh -c pkill -9 11
- pkill -9 11
- sh -c pkill -9 \"11\"
- sh -c pkill -9 12
- pkill -9 12
- sh -c pkill -9 \"12\"
- sh -c pkill -9 13
- pkill -9 13
- sh -c pkill -9 \"13\"
- sh -c pkill -9 14
- pkill -9 14
- sh -c pkill -9 \"14\"
- sh -c pkill -9 15
- pkill -9 15
- sh -c pkill -9 \"15\"
- sh -c pkill -9 16
- pkill -9 16
- sh -c pkill -9 \"16\"
- sh -c pkill -9 17
- pkill -9 17
- sh -c pkill -9 \"17\"
- sh -c pkill -9 18
- pkill -9 18
- sh -c pkill -9 \"18\"
- sh -c pkill -9 19
- pkill -9 19
- sh -c pkill -9 \"19\"
- sh -c pkill -9 2
- pkill -9 2
- sh -c pkill -9 \"2\"
- sh -c pkill -9 203
- pkill -9 203
- sh -c pkill -9 \"203\"
- sh -c pkill -9 4
- pkill -9 4
- sh -c pkill -9 \"4\"
- sh -c pkill -9 5
- pkill -9 5
- sh -c pkill -9 \"5\"
- sh -c pkill -9 6
- pkill -9 6
- sh -c pkill -9 \"6\"
- sh -c pkill -9 7
- pkill -9 7
- sh -c pkill -9 \"7\"
- sh -c pkill -9 8
- pkill -9 8
- sh -c pkill -9 \"8\"
- sh -c pkill -9 9
- pkill -9 9
- sh -c pkill -9 \"9\"
- sh -c pkill -9 [A4]*
- pkill -9 [A4]*
Kills system processes:
- sshd
Kills the following processes:
- kworker/0:1
- scsi_eh_1
- scsi_tmf_1
- kworker/u2:1
- kworker/0:1H
- jbd2/sda1-8
- kworker/u2:0
- kworker/u2:2
- kworker/u2:3
- kworker/u2:4
- kworker/0:2
- ext4-rsv-conver
- exim4
- ipv6_addrconf
- systemd
- kthreadd
- ksoftirqd/0
- kworker/0:0
- kworker/0:0H
- watchdog/0
- khelper
- kdevtmpfs
- netns
- khungtaskd
- writeback
- ksmd
- crypto
- kintegrityd
- bioset
- kblockd
- ata_sff
- rpciod
- kswapd0
- fsnotify_mark
- nfsiod
- kthrotld
- scsi_eh_0
- scsi_tmf_0
- deferwq
- kauditd
- systemd-journal
- systemd-udevd
- khubd
- dhclient
- kworker/0:3
- rpcbind
- rpc.statd
- rpc.idmapd
- cron
- atd
- systemd-logind
- rsyslogd
- dbus-daemon
- agetty
- bash
- run.sh
- <SAMPLE>
- /bin/sh
Performs operations with the file system:
Creates or modifies files:
- /etc/resolv.conf
Deletes files:
- /tmp/*
- /var/tmp/*
- /var/log/wtmp
- /bin/netstat
- /root/.bash_history
- /var/log/lastlog
Network activity:
Establishes connection:
- 8.#.8.8:53
- 46.##.165.131:17769
Sends data to the following servers:
- 46.##.165.131:17769
Other:
Collects CPU information