Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/profile.d/cron.sh
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/bash -c touch -acmt 201411130208 /bin/cron
- touch -acmt 201411130208 /bin/cron
- /bin/bash -c touch -acmt 201411130208 /etc/profile.d/cron.sh
- touch -acmt 201411130208 /etc/profile.d/cron.sh
- /bin/cron
Performs operations with the file system:
Creates or modifies files:
- /bin/cron
Network activity:
Establishes connection:
- 8.###.240.85:8081
Other:
Collects RAM information