Technical Information
Malicious functions:
Removes itself
Launches processes:
- rm -rf /tmp/*
- rm -rf <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log
- rm -rf /boot/grub/deamon
- rm -rf /boot/grub_disk_genius
- mkdir /tmp/.hax/
- lsof -t /tmp
- lsof -t /root
Kills the following processes:
- bash
- run.sh
- <SAMPLE>
Performs operations with the file system:
Creates folders:
- /tmp/.hax
Creates or modifies files:
- /root/stdout.log (deleted)
Deletes files:
- /tmp/*
- /root/run.sh
- /boot/grub/deamon
- /boot/grub_disk_genius