Technical Information
Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
- /sbin/iptables -t mangle -D PREROUTING -p tcp --dport 80 -j QUEUE
- /sbin/iptables -t mangle -D POSTROUTING -p tcp --sport 80 -j QUEUE
- /sbin/iptables -n -L OUTPUT
Launches processes:
- /bin/sh -c /sbin/iptables -t mangle -D PREROUTING -p tcp --dport 80 -j QUEUE
- /bin/sh -c /sbin/iptables -t mangle -D POSTROUTING -p tcp --sport 80 -j QUEUE
- /bin/sh -c /sbin/iptables -n -L OUTPUT > /tmp/pink/protect_ipt_check
Performs operations with the file system:
Creates folders:
- /tmp/pink
Creates or modifies files:
- /tmp/pink/cnc_live
- /tmp/pink/p2p_cncproxy_status
- /tmp/pink/cnc_live_proxy
- /tmp/pink/cnc_runtype
- /tmp/pink/protect_ipt_check
Deletes files:
- /tmp/client
- /tmp/pink/cncproxy_validinfo
- /tmp/pink/fc_ip
- /tmp/pink/fc_port
- /tmp/pink/cache_finder_page_web
Locks files:
- /tmp/pink/cnc_live
- /tmp/pink/cnc_live_proxy
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:61889
- 0.0.0.0:123
- 127.0.0.1:61869
Establishes connection:
- 8.#.8.8:53
- 20#.##.56.48:1088
HTTP GET requests:
- 48.##.11.204/
DNS ASK:
- cn#.##nklander.com