Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- /proc/self/fd/3 #
Performs operations with the file system:
Creates folders:
- /etc/dbus.d
Creates or modifies files:
- /memfd:libc.so.6 (deleted)
- <SAMPLE_FULL_PATH>
- /tmp/.initramfs.bQaGyp
- /tmp/.YlrXp1
Deletes files:
- /usr/bin/mysql
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:116
Establishes connection:
- 127.0.0.1:3306
Sends data to the following servers:
- 45.##.224.178:80
Other:
Collects RAM information
Collects information about network activity