Technical Information
Malicious functions:
Launches itself as a daemon
Manages services:
- systemctl daemon-reload
Launches processes:
- sh -c systemctl daemon-reload
- sh -c /tmp/.-1680896196
- /tmp/.-1680896196
- rpm -q gtk-qt-engine
Performs operations with the file system:
Modifies file access rights:
- /tmp/brtCMhWO
- /tmp/brasOPMg
Creates or modifies files:
- /tmp/.-1680896196
- /lib/systemd/system/rpc-statd-sync.service
- /tmp/brtCMhWO
- /tmp/br5nistx
- /tmp/brasOPMg
Deletes files:
- /tmp/brtCMhWO
- /tmp/br5nistx
- /tmp/brasOPMg
- /tmp/.-1680896196