Technical Information
Malicious functions:
Substitutes application name for:
- rpcbind
Modifies firewall settings:
- /sbin/iptables -S
Manages services:
- systemctl daemon-reload
- systemctl enable systemd-hwdb-upgrade.service
Launches processes:
- /proc/self/exe /sbin/rpcbind -w
- sh -c systemctl daemon-reload &>/dev/null
- sh -c systemctl enable systemd-hwdb-upgrade.service &>/dev/null
- sh -c /sbin/iptables -S
Performs operations with the file system:
Modifies file access rights:
- /etc/iproute2/rt_ksfield
- /usr/lib/libXxf86dag.so.1.0.0
Creates symlinks:
- /usr/lib/libXxf86dag.so
Creates or modifies files:
- /tmp/.X11-unix/Xa
- <SAMPLE_FULL_PATH>
- /etc/iproute2/rt_ksfield
- /lib/systemd/system/systemd-hwdb-upgrade.service
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:56268
Sends data to the following servers:
- 21#.##9.27.5:57491
- 18#.##.45.252:52085
- 66.###.179.13:33543
- 12#.##0.43.45:49252