Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Gets access to SSH keys
- /root/.ssh/<SAMPLE>
Launches processes:
- crontab -
- (2>/dev/null crontab -l ; echo \x22*/1 * * * * ~/.ssh/<SAMPLE> -mc\x22) | crontab -
- crontab -l
- ~/.ssh/<SAMPLE> -ms
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.zjo5uv
Creates or modifies files:
- /var/spool/cron/crontabs/tmp.zjo5uv
- /var/spool/cron/.ssh/.c
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Other:
Collects CPU information
Collects RAM information
Collects information about network activity