Technical Information
Malicious functions:
Removes itself
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'storm.service']
Launches processes:
- /usr/bin/storm
- mount -o rw,remount /
- id -g
- /usr/bin/getconf CLK_TCK
- mount -o rw,remount /usr
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/storm
Creates or modifies files:
- /proc/480/oom_adj
- /proc/480/oom_score_adj
- /usr/bin/storm
- /proc/494/oom_adj
- /proc/494/oom_score_adj
- /etc/systemd/system/storm.service
- /etc/storm.key
Mounts file systems:
- /dev/mmcblk0p2
- /root/none
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:32791
Establishes connection:
- <LOCAL_DNS_SERVER>51
- 17#.##2.7.102:443
- <LOCAL_DNS_SERVER>
- 10#.##1.131.82:4001
DNS ASK:
- _d######.bootstrap.libp2p.io
Sends data to the following servers:
- <LOCAL_DNS_SERVER>51
- 23#.###.255.250:1900
- 17#.##2.7.102:443
- 10#.##1.131.82:4001
Receives data from the following servers:
- <LOCAL_DNS_SERVER>51
- 17#.##2.7.102:443
- 10#.##1.131.82:4001
Other:
Collects CPU information
Collects information about network activity