Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/selinux
Creates or modifies the following symlinks:
- /etc/rc2.d/S99selinux
- /etc/rc3.d/S99selinux
- /etc/rc4.d/S99selinux
- /etc/rc5.d/S99selinux
Malicious functions:
Launches itself as a daemon
Manages services:
- service iptables stop
- systemctl stop iptables.service
Launches processes:
- sh -c service iptables stop 2>/dev/null
- sh -c chkconfig iptables off 2>/dev/null
- sh -c cp <SAMPLE_FULL_PATH> /usr/bin/.zip.swp -rf
- cp <SAMPLE_FULL_PATH> /usr/bin/.zip.swp -rf
- sh -c cp <SAMPLE_FULL_PATH> /usr/share/man/man3/ast.gz -rf
- cp <SAMPLE_FULL_PATH> /usr/share/man/man3/ast.gz -rf
- sh -c cp <SAMPLE_FULL_PATH> /usr/bin/camplz -rf
- cp <SAMPLE_FULL_PATH> /usr/bin/camplz -rf
- sh -c chmod u+x /usr/bin/camplz 2>/dev/null
- chmod u+x /usr/bin/camplz
- sh -c chmod u+x /usr/bin/.zip.swp 2>/dev/null
- chmod u+x /usr/bin/.zip.swp
- sh -c chmod u+x /usr/share/man/man3/ast.gz 2>/dev/null
- chmod u+x /usr/share/man/man3/ast.gz
- sh -c chmod u+x /usr/bin/acpid 2>/dev/null
- chmod u+x /usr/bin/acpid
- sh -c mkdir -p /usr/bin/dbus
- mkdir -p /usr/bin/dbus
- sh -c chmod u+x /usr/bin/dbus/dbus-daemon-draw
- chmod u+x /usr/bin/dbus/dbus-daemon-draw
- sh -c echo \"#acpid conf\" >>/etc/init/acpid.conf
- sh -c echo \"start on RUNLEVEL[12345]\" >>/etc/init/acpid.conf
- sh -c echo \"respawn\" >>/etc/init/acpid.conf
- sh -c echo \"exec /usr/bin/acpid &\" >>/etc/init/acpid.conf
- sh -c echo \"/usr/bin/acpid\" >>/etc/rc.sysinit
- sh -c nohup bash /usr/bin/acpid 2>/dev/null &
- sh -c nohup bash /usr/bin/dbus/dbus-daemon-draw 2>/dev/null &
- nohup bash /usr/bin/acpid
- bash /usr/bin/acpid
- nohup bash /usr/bin/dbus/dbus-daemon-draw
- bash /usr/bin/dbus/dbus-daemon-draw
- sleep 1
- pgrep camplz
- cp /usr/bin/camplz .
- rm camplz
- camplz
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/camplz
- /usr/bin/.zip.swp
- /usr/share/man/man3/ast.gz
- /usr/bin/acpid
- /usr/bin/dbus/dbus-daemon-draw
- /etc/init.d/selinux
Creates folders:
- /usr/bin/dbus
Creates or modifies files:
- /usr/bin/.zip.swp
- /usr/share/man/man3/ast.gz
- /usr/bin/camplz
- /usr/bin/acpid
- /usr/bin/dbus/dbus-daemon-draw
- /etc/init/acpid.conf
- /etc/rc.sysinit
- /camplz
- /root/camplz
- /tmp/ddkadlfadiiahjmdcllf
- /tmp/config.f
Deletes files:
- /etc/rc.d/rc2.d/S99selinux
- /etc/rc.d/rc3.d/S99selinux
- /etc/rc.d/rc4.d/S99selinux
- /etc/rc.d/rc5.d/S99selinux
- /tmp/camplz
Network activity:
Establishes connection:
- 11#.###.166.57:10993
Other:
Collects CPU information
Collects RAM information
Collects information about network activity