Technical Information
Malicious functions:
Removes itself
Launches processes:
- /bin/.securetty/.esd-644/auditd
- /bin/bash
- /bin/sh -c kill -9 684
- /bin/sh -c nohup /bin/.securetty/.esd-644/auditd.tmp > /dev/null 2>&1 &
- nohup /bin/.securetty/.esd-644/auditd.tmp
- /bin/.securetty/.esd-644/auditd.tmp
- /bin/sh
- /bin/sh -c kill -9 691
- /bin/sh -c nohup /bin/.securetty/.esd-644/devkit-power-daemon > /dev/null 2>&1 &
- nohup /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/sh -c kill -9 735
- bash -c uname -r;cat /etc/issue
- uname -r
- cat /etc/issue
Kills the following processes:
- <SAMPLE>
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/devkit-power-daemon
Performs operations with the file system:
Modifies file access rights:
- /bin/.securetty/.esd-644
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/auditd.tmp
- /bin/.securetty/.esd-644/devkit-power-daemon
Creates folders:
- /bin/.securetty
- /bin/.securetty/.esd-644
Creates or modifies files:
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/.nginx.lockfile
- /bin/.securetty/.esd-644/auditd.tmp
- /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/.httpd.lockfile
- /bin/.securetty/.esd-644/.1e8247d9f7f3f4fe8f1c097094d7ff08
Deletes files:
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/auditd.tmp
- /bin/.securetty/.esd-644/devkit-power-daemon
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 18#.##4.218.247:53
HTTP GET requests:
- bo#.#####g.com:80/l/sodd/ver
- bo#.######.com:80/l/sodd/Security.Guard
- bo#.######.#om:80/l/sodd/Security.Script
DNS ASK:
- bo#.#onf1g.com
- lo#.#onf1g.com
Sends data to the following servers:
- 18#.##4.218.247:53
Receives data from the following servers:
- 18#.##4.218.247:53
Other:
Collects OS information
Collects RAM information