Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- cat /var/tmp/..../.nva/.local
- mkdir /var/tmp/.../.nva
- chattr -i /root/.ssh
- chattr -i /root/.ssh/authorized_keys
- chmod 600 /root/.ssh/authorized_keys
- chattr +i /root/.ssh/authorized_keys
- sleep 5
- /1
- grep -q run
- crontab -l
- rm -rf /.tempo
- sleep 1
- crontab /.tempo
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.7BsFK1
Creates or modifies files:
- /var/tmp/..../.nva/.local
- /.tempo
- /var/spool/cron/crontabs/tmp.7BsFK1
Deletes files:
- /.tempo
Other:
Collects RAM information