Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/samba
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
- <SAMPLE_FULL_PATH> postgresql-auto-update
- /root/linux-gnu system-update
- /bin/sh -c cd /tmp/seconfig/ && /bin/sh z.sh
- /bin/sh z.sh
- /bin/sh -c /tmp/seconfig/xorgg
- /tmp/seconfig/xorgg
Performs operations with the file system:
Creates folders:
- /tmp/seconfig
- /etc/seconfig
Creates or modifies files:
- /root/linux-gnu
- <SAMPLE_FULL_PATH>
- /tmp/seconfig//xorgg
- /tmp/seconfig/xorgg
- /tmp/seconfig/config.json
Deletes files:
- /var/log/utmp
- /var/log/wtmp
- /var/log/lastlog
- /var/log/secure
- /root/linux-gnu
- /tmp/seconfig/z.sh
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:47292
- 127.0.0.1:37373
Establishes connection:
- 10#.##3.83.23:27
- <LOCAL_DNS_SERVER>
- 37.##.45.174:0
- 78.##.91.134:0
- 37.##.44.93:0
- 37.##.54.205:0
- 37.##7.154.79:0
- 17#.#.53.68:0
- 37.##.55.60:0
- 17#.#.53.68:7777
HTTP GET requests:
- 21#.###.114.75/iizxcv.sh
- 21#.###.##4.75/xorgg_linux_amd64
- 21#.##5.114.75/con
DNS ASK:
- po##.#inexmr.com
Sends data to the following servers:
- 17#.#.53.68:7777
Receives data from the following servers:
- 10#.##3.83.23:27
- 17#.#.53.68:7777
Other:
Collects CPU information