Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches processes:
- base64 -d
- sh
- mkdir /var/tmp/.gg done
- mkdir /var/tmp/.gg/.bk
- cp /var/tmp/.gg/.bk/x /var/tmp/.gg/ done
- chmod +x /var/tmp/.gg/x done
- sleep 2s
- sleep 5s
- chmod +x /var/tmp/.gg/*
- rm -rf *.txt top x
- rm x6
- crontab -
- pkill echo
- grep sleep 3m
- ps aux
- awk {print $2}
- grep sleep 15m
- sleep 15s
Kills the following processes:
- /bin/grep
Performs operations with the file system:
Modifies file access rights:
- /done
- /var/spool/cron/crontabs/tmp.Vvnlvn
Creates folders:
- /var/tmp/.gg
- /done
- /var/tmp/.gg/.bk
Creates or modifies files:
- /var/spool/cron/crontabs/tmp.Vvnlvn
Deletes files:
- /var/tmp/.gg/*.txt
- /var/tmp/.gg/top
- /var/tmp/.gg/x
- /var/tmp/.gg/x6
Other:
Collects CPU information
Collects RAM information
Collects information about network activity