Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- crontab -l
- /bin/bash -c crontab -l
- /etc/r2f0q4lp8zrc1 idle_inject/0
- /bin/sh -c crontab -l
Performs operations with the file system:
Deletes folders:
- /etc/console-setup
- /etc/update-motd.d
Creates or modifies files:
- /etc/r2f0q4lp8zrc1
Deletes files:
- /etc/r2f0q4lp8zrc1
- /etc/console-setup
- /etc/libaudit.conf
- /etc/mailcap.order
- /etc/nftables.conf
- /etc/nsswitch.conf
- /etc/update-motd.d
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:57135
- 127.0.0.1:59513
Establishes connection:
- 127.0.0.1:57135
- 127.0.0.1:59513
- 8.#.8.8:53
- 17#.##4.220.121:9
- [2######50:4010:c09::79]:9
- 17#.##4.220.121:443
Sends data to the following servers:
- 8.#.8.8:53
- 17#.##4.220.121:443
Receives data from the following servers:
- 8.#.8.8:53
- 17#.##4.220.121:443
Other:
Collects CPU information
Collects information about network activity