Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- /bin/sh -c <SAMPLE_FULL_PATH> -sh &
- <SAMPLE_FULL_PATH> -sh
- /bin/sh -c killall telnetd
- /bin/sh -c killall igdmptd
Attempts to kill system processes:
- killall telnetd
Attempts to kill the following processes:
- killall igdmptd
Performs operations with the file system:
Creates or modifies files:
- /tmp/set.txt
- /tmp/ct.txt
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- ge#####.xyz:80/drx/setx.txt
- ge#####.xyz:80/drx/ct.asp
DNS ASK:
- ge##uck.xyz