Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/<SAMPLE>
Malicious functions:
Launches processes:
- /tmp/vqm2601f6bc10/lmuvusbq0dbnm8b154cc3
- cp -f <SAMPLE_FULL_PATH> /etc/init.d/
- /bin/sh -c cp -f <SAMPLE_FULL_PATH> /etc/init.d/ > /dev/null 2>&1
Performs operations with the file system:
Modifies file access rights:
- /tmp/vqm2601f6bc10/libc.so.0
- /tmp/vqm2601f6bc10/ld-uClibc.so.1
- /tmp/vqm2601f6bc10/lmuvusbq0dbnm8b154cc3
Creates folders:
- /tmp/vqm2601f6bc10
Deletes folders:
- /tmp/.XIM-unix
- /tmp/systemd-private-8c56d284704f4feab9118653b4bfab3f-systemd-timesyncd.service-Z1ENgX/tmp
- /tmp/systemd-private-8c56d284704f4feab9118653b4bfab3f-systemd-timesyncd.service-Z1ENgX
- /tmp/.X11-unix
- /tmp/.ICE-unix
- /tmp/tmux-0
- /tmp/.font-unix
- /tmp/.Test-unix
Creates or modifies files:
- /tmp/vqm2601f6bc10/libc.so.0
- /tmp/vqm2601f6bc10/ld-uClibc.so.1
- /tmp/vqm2601f6bc10/lmuvusbq0dbnm8b154cc3
- /etc/resolv.conf
Deletes files:
- /tmp/tmux-0/default
Network activity:
Establishes connection:
- 47.##2.19.25:80
DNS ASK:
- se######cloud.symantec.com
Sends data to the following servers:
- 47.##2.19.25:80
Receives data from the following servers:
- 47.##2.19.25:80