Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.hourly/anacron
Malicious functions:
Removes itself
Launches processes:
- /bin/sh -c ([crypto] &)
- [crypto]
- /bin/sh -c touch -r /etc/cron.hourly/0anacron /etc/cron.hourly/anacron
- touch -r /etc/cron.hourly/0anacron /etc/cron.hourly/anacron
- /bin/sh -c id
- id
- /bin/sh -c uname -a
- uname -a
Performs operations with the file system:
Creates or modifies files:
- /tmp/.4922efcbb2e3ba85f575e37d2d808d2d
- /usr/local/sbin/[crypto]
Deletes files:
- /usr/local/sbin/[crypto]
- /tmp/.4922efcbb2e3ba85f575e37d2d808d2d
- /tmp/.lang-unix
Network activity:
Establishes connection:
- 8.#.8.8:53
HTTP POST requests:
- 45.##.##9.124/v2/index.php
DNS ASK:
- m.####dserver.com
- a.####dserver.com