Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Modifies firewall settings:
- iptables -F
- iptables --flush
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- openssl rand -hex 5
- chattr -i -a -j -t -d -u /usr
- chattr -i -a -j -t -d -u /usr/bin
- chattr -i -a -j -t -d -u /usr/local
- chattr -i -a -j -t -d -u /usr/local/share
- chattr -i -a -j -t -d -u /usr/local/share/.logfile
- chmod +x /usr/local/share/.logfile
- id -u
- chattr -i -a -j -t -d -u /root
- mkdir /root/.ssh
- chmod 600 /root/.ssh/authorized_keys
- chattr +i /root/.ssh/authorized_keys
- cp /usr/sbin/rmt_remount-open /usr/bin/d8cd5632dc
- /usr/bin/d8cd5632dc
- rm -rf /usr/bin/d8cd5632dc
Performs operations with the file system:
Modifies file access rights:
- /root/.rnd
- /root/.ssh/authorized_keys
Creates folders:
- /root/.ssh
Creates or modifies files:
- /root/.rnd
- /etc/resolv.conf
- /usr/local/share/.logfile
Deletes files:
- /usr/bin/d8cd5632dc
Other:
Collects RAM information