Technical Information
Malicious functions:
Compiles a program from source codes:
- gcc /tmp/.exp.c -o /tmp/.exp
Performs process tracing:
- <SAMPLE>
- /usr/bin/gpasswd
Injects data to the following processes:
- /usr/bin/gpasswd
Launches processes:
- /usr/bin/gpasswd
- /bin//sh -c echo \"#include <stdio.h
- rm /tmp/.exp.c
- chmod +s /tmp/.exp
Performs operations with the file system:
Creates or modifies files:
- /tmp/.exp.c
- /tmp/ccyVGhbd.s
Deletes files:
- /tmp/ccyVGhbd.s
- /tmp/.exp.c