Technical Information
To ensure autorun and distribution:
Creates or modifies the following symlinks:
- /etc/rc2.d/S99serviceqaxsafe
- /etc/rc3.d/S99serviceqaxsafe
- /etc/rc4.d/S99serviceqaxsafe
- /etc/rc5.d/S99serviceqaxsafe
Malicious functions:
Launches itself as a daemon
Launches processes:
- setenforce 0 2>/dev/null
Performs operations with the file system:
Creates folders:
- /root/Log
Creates symlinks:
- /usr/bin/qaxtray
Creates or modifies files:
- /root/Log/entclient.log
- /root/.qaxsafed.lock
- /root/.qaxsafed.pid
- /root/Data/soft_run_status.dat_bak
Locks files:
- /root/.qaxsafed.lock
- /root/.qaxsafed.pid