Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rcS
Malicious functions:
Launches processes:
- sh -c readlink /proc/*/cmdline
- sh -c pkill python
- pkill python
- readlink /proc/1/cmdline /proc/10/cmdline /proc/11/cmdline /proc/119/cmdline /proc/12/cmdline /proc/127/cmdline /proc/129/cmdline /proc/13/cmdline /proc/133/cmdline /proc/14/cmdline /proc/15/cmdline /proc/151/cmdline /proc/16/cmdline /proc/17/cmdline /proc/18/cmdline /proc/19/cmdline /proc/2/cmdline /proc/20/cmdline /proc/25/cmdline /proc/26/cmdline /proc/27/cmdline /proc/28/cmdline /proc/29/cmdline /proc/3/cmdline /proc/353/cmdline /proc/374/cmdline /proc/383/cmdline /proc/388/cmdline /proc/391/cmdline /proc/398/cmdline /proc/399/cmdline /proc/4/cmdline /proc/400/cmdline /proc/401/cmdline /proc/403/cmdline /proc/405/cmdline /proc/409/cmdline /proc/429/cmdline /proc/430/cmdline /proc/5/cmdline /proc/57/cmdline /proc/58/cmdline /proc/59/cmdline /proc/6/cmdline /proc/60/cmdline /proc/668/cmdline /pro[rkmodule] [sh][PPID:0x2b5] [pkill][PID:0x2b6] sys_lseek. File: \"/lib/arm-linux-gnueabi/libprocps.so.3.0.0\
- sh -c rm -rf /tmp/*
- rm -rf /tmp/*
Kills the following processes:
- Unknown process with PID: 3203960848
Performs operations with the file system:
Deletes files:
- /tmp/*
Network activity:
Establishes connection:
- 18#.##4.25.200:3134
Other:
Collects CPU information