Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /memfd:[kworker/1:1 (deleted) /usr/sbin/atd
- /memfd:[kworker/1:1 (deleted) kworker/1:1
- /sbin/ldconfig -p
Performs operations with the file system:
Creates or modifies files:
- /memfd:[kworker/1:1] (deleted)
- /memfd:libc.so.6 (deleted)
Network activity:
Establishes connection:
- 127.0.0.1:443
Other:
Collects CPU information
Collects RAM information
Collects information about network activity