Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
- gcc -Wall -fPIC -shared -o libsystemdpre.so libsystemdpre.c -ldl
Launches processes:
- chmod +x /etc/cron.hourly/rootd
- chattr +i /etc/cron.hourly/rootd
- chmod +x /etc/cron.daily/logrotatedmn
- chattr +i /etc/cron.daily/logrotatedmn
- chmod +x /etc/cron.weekly/crontabtimer
- chattr +i /etc/cron.weekly/crontabtimer
- chmod +x /etc/cron.monthly/log
- chattr +i /etc/cron.monthly/log
- cp <SAMPLE_FULL_PATH> /bin/syslogdmn
Performs operations with the file system:
Modifies file access rights:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
- /tmp/libsystemdpre.so
- /usr/lib/libsystemdpre.so
Creates folders:
- /etc/cron.hourly:
- /etc/cron.hourly:/etc
- /etc/cron.hourly:/etc/cron.daily
Creates or modifies files:
- /etc/ld.so.preload
- /tmp/libsystemdpre.c
- /tmp/cc1YY9xx.s
- /tmp/ccwgw9nb.o
- /tmp/ccJ2o8oQ.res
- /tmp/ccWwrO9T.c
- /tmp/cc57kHtz.o
- /tmp/ccqo1MNe.ld
- /tmp/ccxJBi8T.le
- /tmp/libsystemdpre.so
- /usr/lib/libsystemdpre.so
- /bin/syslogdmn
Deletes files:
- /tmp/ccqo1MNe.ld
- /tmp/ccxJBi8T.le
- /tmp/ccWwrO9T.c
- /tmp/cc57kHtz.o
- /tmp/ccJ2o8oQ.res
- /tmp/ccwgw9nb.o
- /tmp/cc1YY9xx.s
- /tmp/libsystemdpre.c
- /tmp/libsystemdpre.so
Other:
Collects OS information
Collects RAM information