Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Launches processes:
- chmod 755 ./<SAMPLE> ./haloCoreService.pid ./run.sh ./stdout.log
- chmod 755 ./sh/*
- sh -c wget http://csc.ruijie.com.cn/rcc/web/haloFaq/getTools >/dev/null 2>&1
- wget http://csc.ruijie.com.cn/rcc/web/haloFaq/getTools
Performs operations with the file system:
Modifies file access rights:
- <SAMPLE_FULL_PATH>
- /root/haloCoreService.pid
- /root/run.sh
Creates or modifies files:
- /var/log/halo_core_service.log
- /root/haloCoreService.pid
Deletes files:
- /root/halo_core_service.zip
- /root/getTools
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- cs#.######.#om.cn/rcc/web/haloFaq/getTools
DNS ASK:
- cs#.##ijie.com.cn