Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Manages services:
- systemctl enable --now libexecs
Launches processes:
- sh -c whoami
- whoami
- sh -c echo $HOM
- sh -c which crontab
- which crontab
- sh -c crontab -l 2>&1
- crontab -l
- sh -c crontab /tmp/CN3X5e0rNfOsH
- crontab /tmp/CN3X5e0rNfOsH
- sh -c which systemctl
- which systemctl
- sh -c systemctl enable --now libexecs 2>&1
- /bin/libexecs (null
- sh -c cat /etc/machine-id 2>/dev/null
- cat /etc/machine-id
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.7OL3gB
Creates or modifies files:
- /bin/libexecs
- /tmp/CN3X5e0rNfOsH
- /var/spool/cron/crontabs/tmp.7OL3gB
- /lib/systemd/system/multi-user.target.wants/libexecs.service
- /lib/systemd/system/libexecs.service
- /etc/systemd/system/multi-user.target.wants/libexecs.service
- /etc/systemd/system/libexecs.service
Deletes files:
- /tmp/CN3X5e0rNfOsH
Network activity:
DNS ASK:
- 2.##################-sme.4af1f833219a43f8b7b95071c25e58ab.0.124.getTasks