Technical Information
Malicious functions:
Removes itself
Manages services:
- ['systemctl', 'start', 'lcry.service']
- ['systemctl', 'start', 'monitor.service']
Launches processes:
- gzip -d
- openssl enc -pbkdf2 -d -aes256 -pass pass:lcryptor -in /tmp/.lcry650551138/lcry.tgz -out /tmp/.lcry650551138/lcry.dec.tgz
- tar -C /tmp/.lcry650551138 -xpvf /tmp/.lcry650551138/lcry.dec.tgz
Performs operations with the file system:
Modifies file access rights:
- /tmp/.lcry650551138/moon.lcry
- /tmp/.lcry650551138/winner.lcry
Modifies file owner:
- /tmp/.lcry650551138/moon.lcry
- /tmp/.lcry650551138/winner.lcry
Creates folders:
- /tmp/.lcry650551138
Creates or modifies files:
- /tmp/.lcry650551138/lcry.tgz
- /tmp/.lcry650551138/lcry.dec.tgz
- /tmp/.lcry650551138/moon.lcry
- /tmp/.lcry650551138/winner.lcry
- /etc/systemd/system/lcry.service
Deletes files:
- /tmp/.lcry650551138/lcry.dec.tgz
- /tmp/.lcry650551138/lcry.tgz
Changes time of creation/access/modification of files:
- /tmp/.lcry650551138/moon.lcry
- /tmp/.lcry650551138/winner.lcry