Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- sh -c cat /etc/resolv.conf|grep 8.8.8.8 >/dev/null || echo nameserver 8.8.8.8>>/etc/resolv.conf
- cat /etc/resolv.conf
- grep 8.8.8.8
- sh -c ps x|grep -v pts
- grep -v pts
- ps x
- sh -c echo > .3adgbw_flag
Performs operations with the file system:
Creates or modifies files:
- /var/tmp/.config-err
- /etc/resolv.conf
- /tmp/.3adgbw_flag
Locks files:
- /var/tmp/.config-err
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 18.###.187.97:80
DNS ASK:
- ap#.#91666.xyz
Other:
Collects CPU information
Collects RAM information