Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/fcmp
Creates or modifies the following symlinks:
- /etc/rc2.d/S20fcmp
- /etc/rc3.d/S20fcmp
- /etc/rc4.d/S20fcmp
- /etc/rc5.d/S20fcmp
Malicious functions:
Launches processes:
- /bin/sh -c /usr/bin/fcmp 0 1>/dev/null 2>/dev/null &
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/fcmp
- /etc/init.d/fcmp
Deletes folders:
- <SAMPLE_FULL_PATH>
Creates symlinks:
- /etc/rcS.d/S20fcmp
Creates or modifies files:
- /usr/bin/fcmp
Deletes files:
- <SAMPLE_FULL_PATH>