Technical Information
Malicious functions:
Removes itself
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- uname -a
- cat /proc/cpuinfo
- cat /etc/issue
- free -h
- journalctl -S @0 -u sshd
- uptime
- cat /var/log/auth*
- /bin/bash -
- zcat /var/log/auth*
- chattr -ia /root/.ssh/authorized_keys
- gzip -cd /var/log/auth*
- php-fpm
Performs operations with the file system:
Modifies file access rights:
- /root/php-fpm
Creates folders:
- /root/.ssh
Creates or modifies files:
- /php-fpm
- /root/php-fpm
Deletes files:
- /dev/shm/<SAMPLE_FULL_PATH>
- /tmp/<SAMPLE_FULL_PATH>
- /var/tmp/<SAMPLE_FULL_PATH>
- /root/<SAMPLE_FULL_PATH>
- /etc/<SAMPLE_FULL_PATH>
Network activity:
Establishes connection:
- 127.0.0.1:9
- [:#1]:9
- [:##]:1234
- 127.0.0.1:1234
- [:##]:22
- <LOCAL_DNS_SERVER>
- [2#####8c1:3121::2]:9
- [2#####8c1:3120::2]:9
- 18#.#14.96.2:9
- 18#.#14.97.2:9
- 18#.##4.96.2:443
- [2######d0:800:2d50::]:9
- 51.##.217.80:9
- 51.##.217.80:443
- 14#.#51.1.104:9
- 14#.#51.1.105:9
- 14#.#51.1.99:9
- 14#.#51.1.106:9
- 14#.#51.1.103:9
- 14#.#51.1.147:9
- [2######50:4010:c1e::67]:9
- [2######50:4010:c1e::93]:9
- [2######50:4010:c1e::6a]:9
- [2######50:4010:c1e::63]:9
- 14#.##1.1.104:443
- 66.##.110.58:1234
- 14#.##5.52.195:80
- 11#.##.31.33:1234
- 21#.##6.15.97:1234
- 81.##.94.80:1234
- 21#.##6.15.97:22
- 18#.##9.51.96:1234
- 10#.##.47.154:1234
- 22#.##1.91.155:1234
- 19#.###.240.233:1234
- 14#.##.166.7:1234
- 40.###.221.159:1234
- 70.##.248.136:1234
- 52.###.42.216:1234
- 84.###.35.53:1234
- 22#.##1.91.127:1234
- 37.##.54.162:1234
- 31.##.237.170:1234
- 21#.###.184.120:1234
- 90.##.240.185:1234
- 31.##.237.170:2222
- 37.##.54.162:22
- 12#.###.160.116:1234
- 42.###.61.14:1234
- 10#.##2.118.20:1234
- 14#.##3.163.156:80
- 11#.##.159.167:1234
- 27.##.170.52:1234
- 13#.##8.19.134:1234
- 11#.##.173.235:1234
- 12#.###.143.251:1234
- 15#.##7.95.20:1234
- 15#.##.19.149:1234
- 17#.##.35.41:1234
DNS ASK:
- if##nfig.co
- xm##ool.eu
- ww#.#oogle.com
Sends data to the following servers:
- 0.0.0.0:22
- 18#.##4.96.2:443
- 51.##.217.80:443
- 14#.##1.1.104:443
- 66.##.110.58:1234
- 21#.##6.15.97:22
- 19#.###.240.233:1234
- 18#.##9.51.96:1234
- 37.##.54.162:22
- 31.##.237.170:2222
- 90.##.240.185:1234
Receives data from the following servers:
- 0.0.0.0:22
- 18#.##4.96.2:443
- 51.##.217.80:443
- 14#.##1.1.104:443
- 66.##.110.58:1234
- 21#.##6.15.97:22
- 19#.###.240.233:1234
- 18#.##9.51.96:1234
- 37.##.54.162:22
- 31.##.237.170:2222
- 90.##.240.185:1234
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity