Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/ymyninrwbv
- /etc/cron.hourly/cron.sh
- /etc/crontab
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc1.d/S90ymyninrwbv
- /etc/rc2.d/S90ymyninrwbv
- /etc/rc3.d/S90ymyninrwbv
- /etc/rc4.d/S90ymyninrwbv
- /etc/rc5.d/S90ymyninrwbv
- /etc/rc1.d/S01ymyninrwbv
- /etc/rc2.d/S01ymyninrwbv
- /etc/rc2.d/S05rc.local
- /etc/rc3.d/S01ymyninrwbv
- /etc/rc3.d/S05rc.local
- /etc/rc4.d/S01ymyninrwbv
- /etc/rc4.d/S05rc.local
- /etc/rc5.d/S01ymyninrwbv
- /etc/rc5.d/S05rc.local
Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
- update-rc.d ymyninrwbv defaults
- systemctl daemon-reload
Launches processes:
- /boot/ymyninrwbv
- chkconfig --add ymyninrwbv
- sh -c sed -i '/\/etc\/cron.hourly\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab
- sed -i /\/etc\/cron.hourly\/cron.sh/d /etc/crontab
- /sbin/insserv ymyninrwbv
- /boot/zccehsnyne route -n 688
- /boot/ngqdvfxvwa grep \"A\" 688
- /boot/sznuxcwqvq id 688
- /boot/vxvpxsruqf who 688
- /boot/sabyakrkwj echo \"find\" 688
- /boot/qfqhufcdni whoami 688
- /boot/qlggeaytcg cd /etc 688
- /boot/tlumikxjre uptime 688
- /boot/jfbbovrsdz su 688
- /boot/riqzsecapy ps -ef 688
Performs operations with the file system:
Modifies file access rights:
- /etc/sedTHI4RP
Creates or modifies files:
- /lib/udev/udev
- /boot/ymyninrwbv
- /etc/sedTHI4RP
- /boot/hydrcicrfy
- /var/run/sftp.pid
- /run/sftp.pid
- /boot/zccehsnyne
- /boot/ngqdvfxvwa
- /boot/sznuxcwqvq
- /boot/vxvpxsruqf
- /boot/sabyakrkwj
- /boot/qfqhufcdni
- /boot/qlggeaytcg
- /boot/tlumikxjre
- /boot/jfbbovrsdz
- /boot/riqzsecapy
Deletes files:
- /lib/udev/udev
- /etc/rc1.d/S90ymyninrwbv
- /etc/rc2.d/S90ymyninrwbv
- /etc/rc3.d/S90ymyninrwbv
- /etc/rc4.d/S90ymyninrwbv
- /etc/rc5.d/S90ymyninrwbv
- /etc/rc.d/rc1.d/S90ymyninrwbv
- /etc/rc.d/rc2.d/S90ymyninrwbv
- /etc/rc.d/rc3.d/S90ymyninrwbv
- /etc/rc.d/rc4.d/S90ymyninrwbv
- /etc/rc.d/rc5.d/S90ymyninrwbv
- /boot/hydrcicrfy
- /etc/rc2.d/S04rc.local
- /etc/rc3.d/S04rc.local
- /etc/rc4.d/S04rc.local
- /etc/rc5.d/S04rc.local
- /boot/zccehsnyne
- /boot/ngqdvfxvwa
- /boot/sznuxcwqvq
- /boot/vxvpxsruqf
- /boot/sabyakrkwj
- /boot/qfqhufcdni
- /boot/qlggeaytcg
- /boot/tlumikxjre
- /boot/jfbbovrsdz
- /boot/riqzsecapy
Network activity:
Establishes connection:
- 0.0.0.0:7078
- 0.0.0.0:2000
DNS ASK:
- xd##app.me
- be#####gg.benniao.date
Other:
Collects information about network activity