Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.d/init.d/tcp4
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- systemd
Manages services:
- ['systemctl', 'daemon-reload', 'redis.service']
- ['systemctl', 'enable ', 'redis.service']
- ['systemctl', 'daemon-reload', 'mysql.service']
- ['systemctl', 'enable ', 'mysql.service']
Launches processes:
- uname -r
- uname -m
- mount -o bind /var /proc/689/
- <SAMPLE_FULL_PATH> d
- <SAMPLE_FULL_PATH> e
- crontab /var/.recovery
Kills the following processes:
- ksoftirqd/0
- irq/33-mmci-pl1
- mmc_complete
- rcu_sched
- jbd2/mmcblk0p2-
- ext4-rsv-conver
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- kthreadd
- khungtaskd
- oom_reaper
- writeback
- cryptd
- kcompactd0
- ksmd
- khugepaged
- rcu_gp
- kworker/u2:3
- rcu_par_gp
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- watchdogd
- kworker/0:1H
- kswapd0
- kthrotld
- ipv6_addrconf
- kworker/0:0H
- kstrp
- zswap-shrink
- kworker/0:0
- 9bc2fd2a
- kworker/u3:0
- <SAMPLE>
- kworker/u2:0
- kworker/0:5
- uname
- kworker/0:6
- crontab
- gzip
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- migration/0
- logrotate
- dash
- cron
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.hmoFcc
Creates folders:
- /var/web
Creates or modifies files:
- /usr/bin/.kill
- /usr/bin/kill
- /usr/bin/.ls
- /usr/bin/ls
- /var/temp_check_permissions
- /etc/default_dns.conf
- /opt/cgo
- /dev/watchdog
- /var/kernal
- /usr/lib/readdir.so
- /var/.recovery
- /var/web/media.jpg
- /usr/bin/.pwd
- /usr/bin/pwd
- /var/spool/cron/crontabs/tmp.hmoFcc
- /etc/systemd/system/redis.service
- /usr/bin/.mkdir
- /usr/bin/mkdir
- /etc/systemd/system/mysql.service
Deletes files:
- /var/temp_check_permissions
Mounts file systems:
- /var
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:7898
Establishes connection:
- 8.#.8.8:53
- 15#.#.235.76:55655
Sends data to the following servers:
- 8.#.8.8:53
- 15#.#.235.76:55655
Receives data from the following servers:
- 8.#.8.8:53
- 15#.#.235.76:55655
Other:
Collects CPU information
Collects RAM information