Technical Information
Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
- iptables -I INPUT -s 8.210.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 8.210.0.0/16 -j ACCEPT
- iptables -I INPUT -s 8.9.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 8.9.0.0/16 -j ACCEPT
- iptables -I INPUT -s 45.76.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 45.76.0.0/16 -j ACCEPT
- iptables -I INPUT -s 202.182.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 202.182.0.0/16 -j ACCEPT
- iptables -I INPUT -s 108.61.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 108.61.0.0/16 -j ACCEPT
- iptables -I INPUT -s 45.77.0.0/16 -j ACCEPT
- iptables -I OUTPUT -s 45.77.0.0/16 -j ACCEPT
Manages services:
- service iptables restart
- systemctl restart iptables.service
Launches processes:
- sh -c iptables -I INPUT -s 8.210.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 8.210.0.0/16 -j ACCEPT
- sh -c iptables -I INPUT -s 8.9.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 8.9.0.0/16 -j ACCEPT
- sh -c iptables -I INPUT -s 45.76.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 45.76.0.0/16 -j ACCEPT
- sh -c iptables -I INPUT -s 202.182.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 202.182.0.0/16 -j ACCEPT
- sh -c iptables -I INPUT -s 108.61.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 108.61.0.0/16 -j ACCEPT
- sh -c iptables -I INPUT -s 45.77.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 45.77.0.0/16 -j ACCEPT
Performs operations with the file system:
Creates or modifies files:
- /tmp/.vos30000.srv
- /etc/acpi/events/.kunshi_sys.conf
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:9091
Establishes connection:
- <LOCAL_DNS_SERVER>
- 95.###.130.69:8099
DNS ASK:
- sv##.z97.co