Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/config
- /root/.ssh/known_hosts
Launches processes:
- sh -c pgrep netwalker
- pgrep netwalker
- sh -c pidof netwalker
- pidof netwalker
- sh -c <SAMPLE_FULL_PATH> ssh <LOCAL_GATE>:22 \"/root/<LOCAL_GATE>\" 178.21.164.68
- <SAMPLE_FULL_PATH> ssh <LOCAL_GATE>:22 /root/<LOCAL_GATE> 178.21.164.68
Performs operations with the file system:
Creates or modifies files:
- /root/<LOCAL_GATE>.cpass
Deletes files:
- /root/<LOCAL_GATE>.cpass
Network activity:
Establishes connection:
- <LOCAL_GATE>:445
- <LOCAL_GATE>:3389
Attacks using a special dictionary (brute-force technique) via the SSH protocol
DNS ASK:
- CK########AAAAAAAAAAAAAAAAAAAAAA
Other:
Collects CPU information