Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- GNU
Launches processes:
- sh -c mount -o bind /tmp /proc/532 > /dev/null 2>&1
- sh -c setenforce 0 > /dev/null 2>&1
- mount -o bind /tmp /proc/532
- sh -c mount -o bind /tmp /proc/536 > /dev/null 2>&1
- mount -o bind /tmp /proc/536
- sh -c mount -o bind /tmp /proc/539 > /dev/null 2>&1
- sh -c mount -o bind /tmp /proc/540 > /dev/null 2>&1
- mount -o bind /tmp /proc/540
- mount -o bind /tmp /proc/539
Performs operations with the file system:
Mounts file systems:
- /tmp
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:13219
Establishes connection:
- 8.#.8.8:53
- 60.##5.135.0:19
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ev##ve.cf
Sends data to the following servers:
- 95.###.147.143:23
- 45.##.52.191:23
- 23#.##7.154.142:23
- 44.###.169.47:23
- 17#.##2.225.242:23
- 20#.##7.79.110:23
- 18#.##5.49.85:23
- 16#.##.152.254:23
- 37.###.117.69:23
- 8.#.8.8:53