Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rcS
Malicious functions:
Substitutes application name for:
Performs process tracing:
- swapper/0
Manages services:
- ['systemctl', 'list-unit-files', '--full', '--type=socket']
- ['systemctl', 'stop', 'iptables.service']
- ['systemctl', 'stop', 'firewalld.service']
Launches processes:
- /usr/sbin/xtables-nft-multi /sbin/iptables -X
- /bin/sh /usr/sbin/service firewalld stop
- mv <SAMPLE_FULL_PATH> /bin/.developer
- /bin/sh /usr/sbin/service iptables stop
- /usr/sbin/xtables-nft-multi /sbin/iptables -F
- mv /etc/rc.bak /etc/rc.local
- rm -rf /tmp/* /var/* /var/run/* /var/tmp/*
- mv /etc/init.d/rcS.bak /etc/init.d/rcS
- /usr/sbin/xtables-nft-multi iptables -F
- cp /etc/init.d/rcS /etc/init.d/rcS.bak
- rm -rf /bin/netstat
- echo \x27/bin/.developer -d\x27 >> /etc/init.d/rcS
- sed -ne s/\x5c.socket\x5cs*[a-z]*\x5cs*$/.socket/p
- basename /usr/sbin/service
- cp /etc/rc.local /etc/rc.bak
- rm -rf ~/.bash_history
Performs operations with the file system:
Creates or modifies files:
- /run/lock/emptiness.lock
- <SAMPLE_FULL_PATH>
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- em#.#eb2tor.cf