Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- /etc/r6rq7rifizlu3 idle_inject/0
- /bin/bash -c crontab -l
Performs operations with the file system:
Deletes folders:
- /etc/console-setup
- /etc/update-motd.d
Creates or modifies files:
- /etc/r6rq7rifizlu3
Deletes files:
- /etc/r6rq7rifizlu3
- /etc/console-setup
- /etc/libaudit.conf
- /etc/mailcap.order
- /etc/nftables.conf
- /etc/nsswitch.conf
- /etc/update-motd.d
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:57135
- 127.0.0.1:59513
Establishes connection:
- 127.0.0.1:57135
- 127.0.0.1:59513
- 8.#.8.8:53
- 64.###.163.121:9
- [2######50:4010:c06::79]:9
- 64.###.163.121:443
Sends data to the following servers:
- 8.#.8.8:53
- 64.###.163.121:443
Receives data from the following servers:
- 8.#.8.8:53
- 64.###.163.121:443
Other:
Collects CPU information
Collects information about network activity