Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.hourly/checkpaidversionvpssim
Malicious functions:
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- cat
- grep opcache.blacklist /etc/php.d/opcache.ini
- /etc/vpssim/menu/inc/re-start-php-fpm-service
- chmod +x /etc/cron.hourly/checkpaidversionvpssim
Performs operations with the file system:
Modifies file access rights:
- /etc/cron.hourly/checkpaidversionvpssim
Creates or modifies files:
- /etc/logrotate.d/nginx
- /tmp/sh-thd-201187253
- /etc/logrotate.d/php-fpm
- /tmp/sh-thd-201187252
- /etc/logrotate.d/mysql
- /etc/php.d/opcache.ini
- /etc/vpssim/opcache.blacklist
- /etc/vpssim/vpssim.config.firstime
Deletes files:
- /tmp/sh-thd-201187253
- /tmp/sh-thd-201187252
Other:
Collects RAM information