Technical Information
Malicious functions:
Removes itself
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- uname -a
- cat /proc/cpuinfo
- cat /etc/issue
- journalctl -S @0 -u sshd
- free -h
- uptime
- cat /var/log/auth*
- zcat /var/log/auth*
- /bin/bash -
- gzip -cd /var/log/auth*
- chattr -ia /root/.ssh/authorized_keys
Performs operations with the file system:
Creates folders:
- /root/.ssh
Deletes files:
- /dev/shm/<SAMPLE_FULL_PATH>
- /tmp/<SAMPLE_FULL_PATH>
- /var/tmp/<SAMPLE_FULL_PATH>
- /root/<SAMPLE_FULL_PATH>
- /etc/<SAMPLE_FULL_PATH>
Network activity:
Establishes connection:
- 127.0.0.1:9
- [:#1]:9
- [:##]:1234
- 127.0.0.1:1234
- [:##]:22
Sends data to the following servers:
- 0.0.0.0:22
Receives data from the following servers:
- 0.0.0.0:22
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity