Technical Information
To ensure autorun and distribution:
Creates or modifies the following symlinks:
- /etc/rc2.d/S88hodin_daemon.sh
Malicious functions:
Launches processes:
- chmod +x script/hodin_daemon.sh
- chmod +x script/delete_startup.sh
- chmod +x script/startup.sh
- cp script/hodin_daemon.sh /etc/init.d
- cp srv_hodin /usr/bin/
- cp srv_hodin /usr/sbin/
- ln -s /etc/init.d/hodin_daemon.sh /etc/rc2.d/S88hodin_daemon.sh
- grep -E Handlers|EV /proc/bus/input/devices
- grep -B1 120013
- tr \n \0
- grep -Eo event[0-9]+
Performs operations with the file system:
Creates or modifies files:
- /var/log/userlog.log
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:4444