Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/crontab
Malicious functions:
Launches itself as a daemon
Manages services:
- /sbin/service crond start
Launches processes:
- sh -c ulimit -HSn 65536
- sh -c cat /proc/cpuinfo|grep cpu\ MHz|sed -e 's/.*:[^0-9]//'
- cat /proc/cpuinfo
- grep cpu MHz
- sed -e s/.*:[^0-9]//
Performs operations with the file system:
Creates or modifies files:
- /etc/sysctl.conf
- /etc/security/limits.conf
- /tmp/spreadDefghi
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:19380
Establishes connection:
- 18#.##6.49.65:19370
HTTP GET requests:
- 18#.##6.49.65/X86
Sends data to the following servers:
- 18#.##6.49.65:19370
Other:
Collects CPU information
Collects information about network activity