Technical Information
Malicious functions:
Launches itself as a daemon
Replaces the following system files:
- /bin/ss
- /bin/netstat
Launches processes:
- sh -c which ss 1>/dev/null 2>&1
- which ss
- sh -c which ss
- sh -c which netstat 1>/dev/null 2>&1
- which netstat
- sh -c which netstat
- sh -c chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat 1>/dev/null 2>&1
- chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat
- sh -c chmod +x /bin/scss 1>/dev/null 2>&1;
- chmod +x /bin/scss
- sh -c cp -f <SAMPLE_FULL_PATH> /bin/ss 1>/dev/null 2>&1;touch -r /bin/sh /bin/ss /bin/scss 1>/dev/null 2>&1;
- cp -f <SAMPLE_FULL_PATH> /bin/ss
- touch -r /bin/sh /bin/ss /bin/scss
- sh -c chattr +i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat 1>/dev/null 2>&1
- chattr +i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat
- sh -c chmod +x /bin/scnetstat 1>/dev/null 2>&1;
- chmod +x /bin/scnetstat
- sh -c cp -f <SAMPLE_FULL_PATH> /bin/netstat 1>/dev/null 2>&1;touch -r /bin/sh /bin/netstat /bin/scnetstat 1>/dev/null 2>&1;
- cp -f <SAMPLE_FULL_PATH> /bin/netstat
- touch -r /bin/sh /bin/netstat /bin/scnetstat
Performs operations with the file system:
Modifies file access rights:
- /bin/scss
- /bin/scnetstat
Creates or modifies files:
- /bin/scss
- /bin/scnetstat