Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/bash -c crontab -l
- crontab -l
Performs operations with the file system:
Deletes folders:
- /etc/emacs
- /etc/fonts
- /etc/groff
Deletes files:
- /etc/emacs
- /etc/fonts
- /etc/fstab
- /etc/groff
- /etc/group
- /etc/hosts
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:50777
Establishes connection:
- 127.0.0.1:50777
- 127.0.0.1:58005
Other:
Collects CPU information
Collects information about network activity