Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc2.d/K01rsyslog
- /etc/rc3.d/K01rsyslog
- /etc/rc4.d/K01rsyslog
- /etc/rc5.d/K01rsyslog
Malicious functions:
Removes itself
Substitutes application name for:
- (sysv-install)
Manages services:
- ['systemctl', 'kill', 'rsyslog']
- ['systemctl', 'disable', 'rsyslog']
- ['systemctl', 'daemon-reload']
- ['systemctl', 'kill', 'syslog']
- ['systemctl', 'disable', 'syslog']
- ['systemctl', 'kill', 'syslog-ng']
- ['systemctl', 'disable', 'syslog-ng']
Launches processes:
- bash -c svcadm disable syslog
- dmidecode -s system-manufacturer
- bash -c service stop syslog-ng
- bash -c systemctl disable syslog
- bash -c systemctl kill rsyslog
- bash -c systemctl disable rsyslog
- /bin/sh /usr/sbin/service stop syslog
- bash -c service stop syslog
- bash -c chkconfig off syslog
- bash -c systemctl kill syslog
- bash -c systemctl kill syslog-ng
- bash -c chkconfig off syslog-ng
- bash -c dmidecode -s system-manufacturer
- /bin/sh /usr/sbin/service stop syslog-ng
- /usr/bin/perl /usr/sbin/update-rc.d rsyslog defaults
- bash -c service stop rsyslog
- basename /usr/sbin/service
- bash -c systemctl disable syslog-ng
- bash -c chkconfig off rsyslog
- /usr/bin/perl /usr/sbin/update-rc.d rsyslog disable
- bash -c svcadm disable syslog-ng
- /bin/sh /lib/systemd/systemd-sysv-install disable rsyslog
- /bin/sh /usr/sbin/service stop rsyslog
- getopt -o r: --long root: -- disable rsyslog
- bash -c svcadm disable rsyslog