Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/urandom
- /etc/init.d/procps
- /etc/init.d/atd
- /etc/init.d/mountnfs.sh
- /etc/init.d/umountroot
- /etc/init.d/mountall.sh
- /etc/init.d/ssh
- /etc/init.d/killprocs
- /etc/init.d/skeleton
- /etc/init.d/mountnfs-bootclean.sh
- /etc/init.d/udev-finish
- /etc/init.d/bootmisc.sh
- /etc/init.d/kbd
- /etc/init.d/reboot
- /etc/init.d/keyboard-setup
- /etc/init.d/networking
- /etc/init.d/single
- /etc/init.d/sendsigs
- /etc/init.d/motd
- /etc/init.d/rcS
- /etc/init.d/halt
- /etc/init.d/dbus
- /etc/init.d/hostname.sh
- /etc/init.d/cron
- /etc/init.d/x11-common
- /etc/init.d/checkroot.sh
- /etc/init.d/kmod
- /etc/init.d/console-setup
- /etc/init.d/rsyslog
- /etc/init.d/mountkernfs.sh
- /etc/init.d/mountall-bootclean.sh
- /etc/init.d/checkfs.sh
- /etc/init.d/bootlogs
- /etc/init.d/umountnfs.sh
- /etc/init.d/mountdevsubfs.sh
- /etc/init.d/rmnologin
- /etc/init.d/nfs-common
- /etc/init.d/rpcbind
- /etc/init.d/umountfs
- /etc/init.d/checkroot-bootclean.sh
- /etc/init.d/hwclock.sh
- /etc/init.d/rc.local
- /etc/init.d/acpid
- /etc/init.d/rc
- /etc/init.d/udev
- /etc/init.d/exim4
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/sh -c /etc/selinux/configs.conf
- /etc/selinux/configs.conf
- /bin/sh -c /var/tmp/agetty
- /var/tmp/agetty
Performs operations with the file system:
Modifies file access rights:
- /etc/selinux/configs.conf
- /var/tmp/agetty
Creates or modifies files:
- /etc/selinux/configs.conf
- /var/tmp/agetty
- /usr/local/share/man/man1/configs.conf
Deletes files:
- /etc/selinux/configs.conf
- /var/tmp/agetty
Network activity:
DNS ASK:
- os.###static.com
- ma##.#liyuninc.com