Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- rsyslogd
- rcu_gp
Launches processes:
- <SAMPLE_FULL_PATH> (deleted) /proc/self/exe
Performs operations with the file system:
Deletes folders:
- /518/exe
- /523/exe
Creates or modifies files:
- /proc/514/task/514/comm
- /proc/514/task/515/comm
- /proc/514/task/516/comm
- /proc/514/task/517/comm
- /proc/514/task/522/comm
- /proc/523/task/523/comm
- /proc/523/task/524/comm
- /proc/523/task/525/comm
- /proc/523/task/526/comm
Deletes files:
- /518/exe
- /523/exe
Network activity:
Establishes connection:
- 45.##.123.158:443