Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/<SAMPLE>
Malicious functions:
Launches processes:
- /tmp/x43aoh3b1331e2672/dh5udwmupiz247708a98 2>&1 &
- cp -f <SAMPLE_FULL_PATH> /etc/init.d/
- /tmp/x43aoh3b1331e2672/dh5udwmupiz247708a98
- cp -f <SAMPLE_FULL_PATH> /etc/init.d/ > /dev/null 2>&1
Kills the following processes:
- dh5udwmupiz2477
Performs operations with the file system:
Modifies file access rights:
- /tmp/x43aoh3b1331e2672/dh5udwmupiz247708a98
Creates folders:
- /tmp/x43aoh3b1331e2672
Deletes folders:
- /tmp/namespace-dev-ifEesB/dev
- /tmp/namespace-dev-ifEesB
- /tmp/systemd-private-763a387e9401454caaf087de26cb9a66-systemd-timesyncd.service-wMAnJD/tmp
- /tmp/systemd-private-763a387e9401454caaf087de26cb9a66-systemd-timesyncd.service-wMAnJD
- /tmp/.XIM-unix
- /tmp/.X11-unix
- /tmp/.ICE-unix
- /tmp/tmux-0
- /tmp/.font-unix
- /tmp/systemd-private-763a387e9401454caaf087de26cb9a66-logrotate.service-74qgNw/tmp
- /tmp/systemd-private-763a387e9401454caaf087de26cb9a66-logrotate.service-74qgNw
- /tmp/.Test-unix
Creates or modifies files:
- /tmp/x43aoh3b1331e2672/dh5udwmupiz247708a98
Deletes files:
- /tmp/tmux-0/default
Network activity:
Establishes connection:
- 47.##3.46.11:80
DNS ASK:
- se####.#ystemupdatecdn.de
Sends data to the following servers:
- 47.##3.46.11:80
Receives data from the following servers:
- 47.##3.46.11:80
Other:
Collects OS information