Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/rc.d/rc.local
Malicious functions:
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Modifies firewall settings:
- iptables -A INPUT -p udp -m udp --sport 10004 -j ACCEPT
- iptables -A INPUT -p tcp -m tcp --sport 10004 -j ACCEPT
- iptables -A FORWARD -p udp -m udp --dport 10004 -j ACCEPT
- iptables -A FORWARD -p tcp -m tcp --dport 10004 -j ACCEPT
- iptables -A OUTPUT -p udp -m udp --dport 10004 -j ACCEPT
- iptables -A OUTPUT -p tcp -m tcp --dport 10004 -j ACCEPT
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- hostname
- sed -r s/[^a-zA-Z0-9\-]+/_/g
- cut -f1 -d.
- sed -i s/\"pass\": *\"[^\"]*\
- mkdir /etc/sysconfig
- iptables-save
- iptables-restore /etc/sysconfig/iptables
- iptables-restore /etc/iptables
- mkdir /usr/src
- chattr -R -iadA /usr/bin
- chattr -R -iadA /usr/sbin
- cp /usr/bin/chattr /usr/bin/t
- yes
- cp /usr/bin/chattr /usr/bin/lynx
- lynx -r -iadA /usr/sbin
- lynx -R -iadA /usr/bin
- cp /usr/bin/lockr /usr/bin/t
- cp /usr/bin/lockr /usr/bin/lynx
- lynx -R -iadA /usr/src
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates folders:
- /etc/sysconfig
Creates or modifies files:
- /etc/sysconfig/iptables
- /etc/iptables
- /usr/bin/t
- /usr/bin/lynx
Network activity:
Establishes connection:
- [:##]:10004
- 127.0.0.1:10004
Other:
Collects RAM information