Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/profile.d/cron.sh
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/cron
- touch -acmt 202203271440 /bin/cron
- touch -acmt 202203271440 /etc/profile.d/cron.sh
- /bin/bash -c touch -acmt 202203271440 /etc/profile.d/cron.sh
- /bin/bash -c touch -acmt 202203271440 /bin/cron
Performs operations with the file system:
Creates or modifies files:
- /usr/bin/cron
Changes time of creation/access/modification of files:
- /bin/cron
- /etc/profile.d/cron.sh
Network activity:
Establishes connection:
- 10#.##.110.83:80
Sends data to the following servers:
- 10#.##.110.83:80
Receives data from the following servers:
- 10#.##.110.83:80