Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Manages services:
- systemctl restart ssh*
Launches processes:
- mkdir -p /root/.ssh
- apt-get install curl
- /usr/bin/dpkg --print-foreign-architectures
- /usr/lib/apt/methods/http
Kills the following processes:
- /usr/lib/apt/methods/http
Performs operations with the file system:
Modifies file access rights:
- /var/cache/apt/pkgcache.bin.oIoeNU
Creates folders:
- /root/.ssh
Creates or modifies files:
- /var/lib/dpkg/lock
- /var/cache/apt/pkgcache.bin.oIoeNU
- /var/cache/apt/archives/lock
- /etc/ssh/sshd_config
Deletes files:
- /var/cache/apt/pkgcache.bin
Other:
Collects RAM information