Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
- /etc/crontab
- /etc/cron.d/root
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- cp <SAMPLE_FULL_PATH> /etc/cron.hourly/rootd
- chmod +x /etc/cron.hourly/rootd
- touch -acmr /bin/sh /etc/cron.hourly/rootd
- chattr +i /etc/cron.hourly/rootd
- cp <SAMPLE_FULL_PATH> /etc/cron.daily/logrotatedmn
- chmod +x /etc/cron.daily/logrotatedmn
- touch -acmr /bin/sh /etc/cron.daily/logrotatedmn
- chattr +i /etc/cron.daily/logrotatedmn
- cp <SAMPLE_FULL_PATH> /etc/cron.weekly/crontabtimer
- chmod +x /etc/cron.weekly/crontabtimer
- touch -acmr /bin/sh /etc/cron.weekly/crontabtimer
- chattr +i /etc/cron.weekly/crontabtimer
- cp <SAMPLE_FULL_PATH> /etc/cron.monthly/log
- chmod +x /etc/cron.monthly/log
- touch -acmr /bin/sh /etc/cron.monthly/log
- chattr +i /etc/cron.monthly/log
- cp <SAMPLE_FULL_PATH> /bin/syslogdmn
- chmod +x /bin/syslogdmn
- touch -acmr /bin/sh /bin/syslogdmn
- chattr +i /bin/syslogdmn
- cp <SAMPLE_FULL_PATH> /sbin/syslogdmn
- chmod +x /sbin/syslogdmn
- touch -acmr /bin/sh /sbin/syslogdmn
- chattr +i /sbin/syslogdmn
- cp <SAMPLE_FULL_PATH> /usr/bin/syslogdmn
- chmod +x /usr/bin/syslogdmn
- touch -acmr /bin/sh /usr/bin/syslogdmn
- chattr +i /usr/bin/syslogdmn
- cp <SAMPLE_FULL_PATH> /usr/sbin/syslogdmn
- chmod +x /usr/sbin/syslogdmn
- touch -acmr /bin/sh /usr/sbin/syslogdmn
- chattr +i /usr/sbin/syslogdmn
- cp <SAMPLE_FULL_PATH> /usr/local/bin/syslogdmn
- chmod +x /usr/local/bin/syslogdmn
- touch -acmr /bin/sh /usr/local/bin/syslogdmn
- chattr +i /usr/local/bin/syslogdmn
- cp <SAMPLE_FULL_PATH> /usr/local/sbin/syslogdmn
- chmod +x /usr/local/sbin/syslogdmn
- touch -acmr /bin/sh /usr/local/sbin/syslogdmn
- chattr +i /usr/local/sbin/syslogdmn
- sh /tmp/root/run_script/eZnyMFmDFM.sh
- sed -i $d /etc/crontab
- sh /tmp/root/run_script/t4B3GcenNt.sh
- sh /tmp/root/run_script/qtBsfSoaxF.sh
- sh /tmp/root/run_script/y4EkB0ApUo.sh
- sh /tmp/root/run_script/in844ubRGi.sh
- sh /tmp/root/run_script/UR93HfE915.sh
- sh /tmp/root/run_script/HKdyloNZaF.sh
- touch -acmr /bin/sh /etc/crontab
- touch -acmr /bin/sh /etc/cron.d/root
- touch -acmr /bin/sh /var/spool/cron/root
- touch -acmr /bin/sh /var/spool/crontabs/root
- sh /tmp/root/run_script/0DCs7V9ddl.sh
- nohup /bin/syslogdmn
- /bin/syslogdmn
- bash /tmp/root/run_script/Kxn8hKfLuH.sh
- ps aux
- grep -i [a]liyun
- grep -i [y]unjing
Performs operations with the file system:
Modifies file access rights:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
- /bin/syslogdmn
- /sbin/syslogdmn
- /usr/bin/syslogdmn
- /usr/sbin/syslogdmn
- /usr/local/bin/syslogdmn
- /usr/local/sbin/syslogdmn
- /etc/sedStnlZQ
Creates folders:
- /tmp/root
- /tmp/root/run_script
Creates or modifies files:
- /bin/syslogdmn
- /sbin/syslogdmn
- /usr/bin/syslogdmn
- /usr/sbin/syslogdmn
- /usr/local/bin/syslogdmn
- /usr/local/sbin/syslogdmn
- /tmp/root/run_script/eZnyMFmDFM.sh
- /etc/sedStnlZQ
- /tmp/root/run_script/t4B3GcenNt.sh
- /var/spool/cron/root
- /tmp/root/run_script/qtBsfSoaxF.sh
- /tmp/root/run_script/y4EkB0ApUo.sh
- /tmp/root/run_script/in844ubRGi.sh
- /tmp/root/run_script/UR93HfE915.sh
- /tmp/root/run_script/HKdyloNZaF.sh
- /tmp/root/run_script/0DCs7V9ddl.sh
- /tmp/root/run_script/Kxn8hKfLuH.sh
Deletes files:
- /tmp/root/run_script/eZnyMFmDFM.sh
- /tmp/root/run_script/t4B3GcenNt.sh
- /tmp/root/run_script/qtBsfSoaxF.sh
- /tmp/root/run_script/y4EkB0ApUo.sh
- /tmp/root/run_script/in844ubRGi.sh
- /tmp/root/run_script/UR93HfE915.sh
- /tmp/root/run_script/HKdyloNZaF.sh
- /tmp/root/run_script/0DCs7V9ddl.sh
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity