Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- /usr/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uuholv
- /usr/local/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uuholv
- /sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uuholv
- /usr/sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uuholv
- /bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uuholv
- /usr/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yaikuf
- /usr/local/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yaikuf
- /sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yaikuf
- /usr/sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yaikuf
- /bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yaikuf
- /usr/bin/chattr -i /etc/ld.so.preload
- /usr/bin/chattr -i /etc/cron.d/root
Kills system processes:
- sshd
Kills the following processes:
- /usr/bin/lsb_release
- systemd
- kthreadd
- ksoftirqd/0
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- rcu_sched
- rcu_bh
- migration/0
- watchdog/0
- khelper
- kdevtmpfs
- netns
- khungtaskd
- writeback
- ksmd
- crypto
- kintegrityd
- bioset
- kblockd
- kworker/0:1
- kswapd0
- fsnotify_mark
- kthrotld
- ipv6_addrconf
- deferwq
- kworker/u2:1
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/u2:2
- kworker/u2:3
- kworker/0:2
- kworker/0:1H
- jbd2/sda1-8
- ext4-rsv-conver
- kauditd
- systemd-journal
- systemd-udevd
- kpsmoused
- ttm_swap
- kworker/0:3
- dhclient
- rpcbind
- rpc.statd
- rpciod
- nfsiod
- rpc.idmapd
- atd
- cron
- systemd-logind
- rsyslogd
- acpid
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates folders:
- /var/lib/.zfnr
- /root/.ssh
Creates or modifies files:
- /var/lib/.zfnr/.local
- /tmp/qtieaz.lock
- /usr/bin/uuholv
- /usr/bin/yaikuf
Network activity:
Establishes connection:
- 22#.#.5.5:53
- 20#.##.222.222:443
- 1.#.1.1:53
- 8.#.8.8:53
- 11#.#9.29.29:53
- 21#.#39.32.21:9
- 21#.#39.34.21:9
- 52.#.197.231:9
- 10#.#2.18.188:9
- 52.###.161.135:9
- 10#.#2.19.188:9
- 52.##6.178.1:9
- 34.###.132.204:9
- 34.##7.12.81:9
- 34.##6.80.17:9
- 34.###.181.158:9
- 21#.#39.38.21:9
- 21#.#39.36.21:9
- 2.##.194.153:9
- 18.###.112.207:9
- 3.###.145.145:9
- 18.###.132.216:9
- 18.##3.90.151:9
- 66.###.248.178:9
- [2#######0:c000:1000::501]:9
- 34.###.250.175:9
- 2.##.194.136:9
- 2.##.255.185:9
- 2.##.254.184:9
- 12#.##.145.255:40621
- 49.###.71.246:46246
- 10#.###.106.71:36463
- 22#.##.142.58:45391
- 58.###.153.29:37369
- 11#.##.207.78:34710
- 12#.##.28.227:33651
- 11#.###.231.63:44602
- 10#.##.201.118:46114
HTTP GET requests:
- v4.##ent.me/
- ip##.#canhazip.com/
- ip###o.io/ip
- wh#####yip.akamai.com/
- bo#.####ismyipaddress.com/
- ip####.net/plain
- ch#####.amazonaws.com/
HTTP POST requests:
- po#.##abtl.com/jobs
DNS ASK:
- ch#####.amazonaws.com
- v4.#dent.me
- bo#.####ismyipaddress.com
- ip##fo.io
- ip##ho.net
- wh#####yip.akamai.com
- ip##.#canhazip.com
Sends data to the following servers:
- 1.#.1.1:53
- 20#.##.222.222:443
- 49.###.71.246:46246
- 22#.##.142.58:45391
- 58.###.153.29:37369
- 10#.##.201.118:46114
Receives data from the following servers:
- 1.#.1.1:53
- 20#.##.222.222:443
- 49.###.71.246:46246
- 22#.##.142.58:45391
- 58.###.153.29:37369
- 10#.##.201.118:46114
Other:
Collects CPU information
Collects RAM information
Collects information about network activity