Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
- /etc/init.d/S11log
- /etc/init.d/urandom
- /etc/init.d/procps
- /etc/init.d/atd
- /etc/init.d/mountnfs.sh
- /etc/init.d/umountroot
- /etc/init.d/mountall.sh
- /etc/init.d/ssh
- /etc/init.d/killprocs
- /etc/init.d/skeleton
- /etc/init.d/mountnfs-bootclean.sh
- /etc/init.d/udev-finish
- /etc/init.d/bootmisc.sh
- /etc/init.d/kbd
- /etc/init.d/reboot
- /etc/init.d/keyboard-setup
- /etc/init.d/networking
- /etc/init.d/single
- /etc/init.d/sendsigs
- /etc/init.d/motd
- /etc/init.d/rcS
- /etc/init.d/halt
- /etc/init.d/dbus
- /etc/init.d/hostname.sh
- /etc/init.d/cron
- /etc/init.d/x11-common
- /etc/init.d/checkroot.sh
- /etc/init.d/kmod
- /etc/init.d/console-setup
- /etc/init.d/rsyslog
- /etc/init.d/mountkernfs.sh
- /etc/init.d/README
- /etc/init.d/mountall-bootclean.sh
- /etc/init.d/checkfs.sh
- /etc/init.d/bootlogs
- /etc/init.d/umountnfs.sh
- /etc/init.d/mountdevsubfs.sh
- /etc/init.d/rmnologin
- /etc/init.d/nfs-common
- /etc/init.d/rpcbind
- /etc/init.d/umountfs
- /etc/init.d/checkroot-bootclean.sh
- /etc/init.d/hwclock.sh
- /etc/init.d/rc.local
- /etc/init.d/acpid
- /etc/init.d/rc
- /etc/init.d/udev
- /etc/init.d/exim4
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Launches processes:
- sh -c echo '10 * * * * /root crontab' | crontab -
- crontab -
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.LpoTWp
Creates or modifies files:
- /var/spool/cron/crontabs/tmp.LpoTWp
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:18945
Establishes connection:
- 8.#.8.8:53
- 8.#.4.4:53
- 1.#.1.1:53
- 1.#.0.1:53
- 9.#.9.9:53
- 20#.##.222.222:53
- 18#.##8.168.9:53
- 19#.##1.242.72:53
- 94.##0.14.14:53
- 20#.##1.45.60:18191
DNS ASK:
- ri##r.cc
Sends data to the following servers:
- 20#.##1.45.60:18191