Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rcS.bak
- /etc/init.d/rcS
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- -bash
Launches processes:
- umount /proc/*
- /usr/sbin/.developer <SAMPLE_FULL_PATH>
- bash -c setenforce 0
- bash -c mount -o bind /tmp /proc/544
- mount -o bind /tmp /proc/544
- cp /etc/rc.local /etc/rc.bak
- fuser -k 21/tcp
- echo '/usr/sbin/.developer -d' >> /etc/rc.local
- cp /etc/init.d/rcS /etc/init.d/rcS.bak
- sh -c echo '/usr/sbin/.developer -d' >> /etc/init.d/rcS
- rm -rf /tmp/* /var/* /var/run/* /var/tmp/*
- echo 0 > /var/log/wtmp
- echo 0 > /var/log/secure
- echo -e
- fuser -k 48101/tcp
- rm -rf /bin/netstat
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
- /etc/rc.bak
Deletes files:
- /tmp/*
- /var/*
- /var/run/*
- /var/tmp/*
- /bin/netstat
Mounts file systems:
- /tmp
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:13372
Establishes connection:
- [:##]:21
- 127.0.0.1:21
Other:
Collects RAM information