Technical Information
Malicious functions:
Removes itself
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- dirname
- dirname /root
- python -
- basename /root
- /usr/local/bin/php -r echo PHP_MAJOR_VERSION.\".\".PHP_MINOR_VERSION;
- mkdir /root/tmp
- cat /root/tmp/test-php-cli.txt
- rm -f /root/tmp/test-php-cli.txt
- rm -f <SAMPLE_FULL_PATH>
- rm -rf /root/run.sh
- rm -rf /root/*.sh
Performs operations with the file system:
Creates folders:
- /root/tmp
Creates or modifies files:
- /tmp/sh-thd-173230721
- /root/tmp/test-php-cli.txt
- /root/deploy-process-root
- /tmp/sh-thd-173230748
- /root/deploy.txt
Deletes files:
- /tmp/sh-thd-173230721
- /root/tmp/test-php-cli.txt
- /tmp/sh-thd-173230748
- /root/run.sh
- /root/*.sh
Other:
Collects RAM information