Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rcS
Malicious functions:
Removes itself
Launches processes:
- sh -c /var/etc/rpc.d
- /var/etc/rpc.d
Performs operations with the file system:
Modifies file access rights:
- /var/etc/rpc.d
- /var/etc/init
Creates folders:
- /var/etc
Creates or modifies files:
- /var/etc/rpc.d
- /var/etc/init
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- ir#####cline4.zapto.org
- ir#####cline1.zapto.org
- ir#####cline2.zapto.org
- ir#####cline5.zapto.org
- ir#####cline3.zapto.org