Technical Information
Malicious functions:
Removes itself
Manages services:
- ['/bin/systemctl', 'enable', 'bot']
Launches processes:
- <SAMPLE_FULL_PATH> 386 .
Performs operations with the file system:
Creates or modifies files:
- /etc/init/bot.conf
- /root/.bashrc
- /usr/lib/systemd/system/bot.service
Network activity:
Establishes connection:
- 89.###.156.4:7070
- 68.##.59.215:21
- 68.##.59.215:22
- 68.##.59.215:23
- 68.##.59.215:80
- 68.##.59.215:443
- 68.##.59.215:502
- 68.##.59.215:1025
- 68.##.59.215:1883
- 68.##.59.215:2002
- 68.##.59.215:2323
- 68.##.59.215:2601
- 68.##.59.215:5523
- 68.##.59.215:5683
- 21#.##.164.33:21
- 21#.##.164.33:22
- 21#.##.164.33:23
- 21#.##.164.33:80
- 21#.##.164.33:443
- 21#.##.164.33:502
Sends data to the following servers:
- 89.###.156.4:7070
Receives data from the following servers:
- 89.###.156.4:7070