Technical Information
Malicious functions:
Modifies firewall settings:
- iptables -D INPUT -p tcp --dport 1919 -j ACCEPT
- iptables -A INPUT -p tcp --dport 1919 -j ACCEPT
Launches processes:
- sh -c iptables -D INPUT -p tcp --dport 1919 -j ACCEPT
- sh -c iptables -A INPUT -p tcp --dport 1919 -j ACCEPT
Performs operations with the file system:
Creates or modifies files:
- /tmp/.ycusdqvyebtbbybdh
Network activity:
Attacks using a special dictionary (brute-force technique) via the SSH protocol
Other:
Collects CPU information
Collects information about network activity