Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- a
Removes the following system files:
- /usr/sbin/reboot
- /usr/sbin/shutdown
- /usr/sbin/poweroff
- /usr/sbin/halt
Kills the following processes:
- <SAMPLE>
- apt-config
- apt-get
- systemd
- apt-helper
- apt.systemd.dai
Performs operations with the file system:
Creates or modifies files:
- /self
- /proc/493/cmdline
Network activity:
Establishes connection:
- 18#.##7.3.184:3589
- 8.#.8.8:53
Receives data from the following servers:
- 18#.##7.3.184:3589