Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- jd7ut5p152i7
Kills the following processes:
- dash
- apt-helper
- apt-config
- find
- gzip
- logrotate
Performs operations with the file system:
Deletes folders:
- /var/log/syslog
- /var/log/daemon.log
- /var/log/btmp
- /var/log/kern.log.1.gz
- /var/log/auth.log.1.gz
- /var/log/debug.1.gz
- /var/log/messages.1.gz
- /var/lib/logrotate/status.tmp
Deletes files:
- /var/log/syslog
- /var/log/daemon.log
- /var/log/btmp
- /var/log/kern.log.1.gz
- /var/log/auth.log.1.gz
- /var/log/debug.1.gz
- /var/log/messages.1.gz
- /var/lib/logrotate/status.tmp
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:9902
Establishes connection:
- 8.#.8.8:53