Technical Information
Malicious functions:
Gains root privileges
Compiles a program from source codes:
- gcc -o payload.so -shared -fPIC payload.c
Launches processes:
- /usr/bin/pkexec (null
- sh
Performs operations with the file system:
Modifies file access rights:
- /root/payload.so
Creates folders:
- /root/GCONV_PATH=.
- /root/lol
Creates or modifies files:
- /root/payload.c
- /tmp/cc0l6rmG.s
- /tmp/ccvtz8Lp.o
- /tmp/cc2zL4db.res
- /tmp/ccl9vsnj.c
- /tmp/ccvNgGs5.o
- /tmp/ccA3HKyR.ld
- /tmp/ccATiqFD.le
- /root/payload.so
- /root/GCONV_PATH=./lol
- /root/lol/gconv-modules
Deletes files:
- /tmp/ccA3HKyR.ld
- /tmp/ccATiqFD.le
- /tmp/ccl9vsnj.c
- /tmp/ccvNgGs5.o
- /tmp/cc2zL4db.res
- /tmp/ccvtz8Lp.o
- /tmp/cc0l6rmG.s
Other:
Collects RAM information