Technical Information
Malicious functions:
Gains root privileges
Compiles a program from source codes:
- gcc -o payload.so -shared -fPIC payload.c
Launches processes:
- /usr/bin/pkexec (null
- sh
Performs operations with the file system:
Modifies file access rights:
- /root/payload.so
Creates folders:
- /root/GCONV_PATH=.
- /root/lol
Creates or modifies files:
- /root/payload.c
- /tmp/ccVjkz7P.s
- /tmp/ccZgweIN.o
- /tmp/ccj103RL.res
- /tmp/ccOy8qoI.c
- /tmp/ccFy5tOG.o
- /tmp/ccsTLHeF.ld
- /tmp/ccVNGdFD.le
- /root/payload.so
- /root/GCONV_PATH=./lol
- /root/lol/gconv-modules
Deletes files:
- /tmp/ccsTLHeF.ld
- /tmp/ccVNGdFD.le
- /tmp/ccOy8qoI.c
- /tmp/ccFy5tOG.o
- /tmp/ccj103RL.res
- /tmp/ccZgweIN.o
- /tmp/ccVjkz7P.s
Other:
Collects RAM information