Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
- gcc -Wall -fPIC -shared -o libsystemdpre.so libsystemdpre.c -ldl
Launches processes:
- chmod +x /etc/cron.hourly/rootd
- chattr +i /etc/cron.hourly/rootd
- chmod +x /etc/cron.daily/logrotatedmn
- chattr +i /etc/cron.daily/logrotatedmn
- chmod +x /etc/cron.weekly/crontabtimer
- chattr +i /etc/cron.weekly/crontabtimer
- chmod +x /etc/cron.monthly/log
- chattr +i /etc/cron.monthly/log
- chmod +x /bin/syslogdmn
- chattr +i /bin/syslogdmn
Performs operations with the file system:
Modifies file access rights:
- /etc/cron.hourly/rootd
- /etc/cron.daily/logrotatedmn
- /etc/cron.weekly/crontabtimer
- /etc/cron.monthly/log
- /tmp/libsystemdpre.so
- /usr/lib/libsystemdpre.so
- /bin/syslogdmn
- /sbin/syslogdmn
Creates folders:
- /etc/cron.hourly:
- /etc/cron.hourly:/etc
- /etc/cron.hourly:/etc/cron.daily
Creates or modifies files:
- /etc/ld.so.preload
- /tmp/libsystemdpre.c
- /tmp/ccrTXaJS.s
- /tmp/cc6wYRve.o
- /tmp/cc9J1PZA.res
- /tmp/cccTRHuL.c
- /tmp/ccUIVve8.o
- /tmp/cc7YiGYu.ld
- /tmp/ccpaQ4IR.le
- /tmp/libsystemdpre.so
- /usr/lib/libsystemdpre.so
- /bin/syslogdmn
- /sbin/syslogdmn
Deletes files:
- /tmp/cc7YiGYu.ld
- /tmp/ccpaQ4IR.le
- /tmp/cccTRHuL.c
- /tmp/ccUIVve8.o
- /tmp/cc9J1PZA.res
- /tmp/cc6wYRve.o
- /tmp/ccrTXaJS.s
- /tmp/libsystemdpre.c
- /tmp/libsystemdpre.so
Other:
Collects OS information
Collects RAM information