Technical Information
Malicious functions:
Removes itself
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- cat /etc/issue
- cat /var/log/auth*
- uptime
- journalctl -S @0 -u sshd
- free -h
- /bin/sh /usr/bin/zcat /var/log/auth*
- uname -a
- cat /proc/cpuinfo
- gzip -cd /var/log/auth*
Performs operations with the file system:
Creates folders:
- /root/.ssh
Network activity:
Establishes connection:
- 127.0.0.1:9
- [:#1]:9
- [:##]:1234
- 127.0.0.1:1234
- [:##]:22
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity