Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- systemd
Launches processes:
- /bin/sh -c cat /etc/redhat-releases
- uname -a
- /bin/sh -c free -h
- cat /proc/cpuinfo
- ps -aux
- cat /etc/lsb-release
- /bin/sh -c cat /proc/cpuinfo
- /bin/sh -c cat /etc/lsb-release
- /bin/sh -c uname -sm
- /bin/sh -c uname -a
- free -h
- /bin/sh -c ps -aux
- /bin/sh -c ps -x -o pid,comm --sort pid
- uname -sm
- cat /etc/redhat-releases
- ps -x -o pid,comm --sort pid
Network activity:
Establishes connection:
- 19#.##.114.54:5050
- 15#.##5.160.73:5050
Sends data to the following servers:
- 19#.##.114.192:5050
- 19#.##.114.54:5050
- 15#.##5.160.73:5050
Receives data from the following servers:
- 19#.##.114.192:5050
- 19#.###.180.162:5050
- 19#.##.114.54:5050
- 15#.##5.160.73:5050
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity