Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dnsconfig
- /etc/rc.d/init.d/dnsconfigs
- /var/spool/cron/crontabs/root
Creates or modifies the following symlinks:
- /etc/rc0.d/S99dnsconfig
- /etc/rc1.d/S99dnsconfig
- /etc/rc2.d/S99dnsconfig
- /etc/rc3.d/S99dnsconfig
- /etc/rc4.d/S99dnsconfig
- /etc/rc5.d/S99dnsconfig
- /etc/rc6.d/S99dnsconfig
- /etc/rc0.d/S99dnsconfigs
- /etc/rc1.d/S99dnsconfigs
- /etc/rc2.d/S99dnsconfigs
- /etc/rc3.d/S99dnsconfigs
- /etc/rc4.d/S99dnsconfigs
- /etc/rc5.d/S99dnsconfigs
- /etc/rc6.d/S99dnsconfigs
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- (sd-askpwagent)
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'dnsconfigs.service']
- ['systemctl', 'start', 'dnsconfigs.service']
Launches processes:
- cp -f <SAMPLE_FULL_PATH> /var/tmp/nginx_kel
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig
- mount -o bind /tmp/nginx_server /proc/541/ > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1
- mount -o bind /tmp/nginx_server /proc/541/
- systemctl daemon-reload > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs
- mount -o bind /tmp/nginx_server /proc/529/
- ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1
- /bin/systemd-tty-ask-password-agent --watch
- mount -o bind /tmp/nginx_server /proc/529/ > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs
- ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig
- ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1
- systemctl enable dnsconfigs.service > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs
- ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1
- systemctl start dnsconfigs.service > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig
- ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs
- crontab /var/tmp/.recoverys
- ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs
- ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig
- ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig
- ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs
- ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1
- ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig
- ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig
Kills the following processes:
- <SAMPLE>
- systemd-tty-ask
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/nginx_kel
- /etc/init.d/dnsconfig
- /var/spool/cron/crontabs/tmp.zMRdup
Creates folders:
- /tmp/nginx_server
Creates symlinks:
- /etc/rcS.d/S99dnsconfig
Creates or modifies files:
- /var/tmp/nginx_kel
- /var/tmp/.recoverys
- /tmp/server_session.lock
- /var/spool/cron/crontabs/tmp.zMRdup
- /etc/systemd/system/dnsconfigs.service
- /dev/tty
Mounts file systems:
- /tmp/nginx_server
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:27120
Establishes connection:
- 8.#.8.8:53
- 127.0.0.1:27120
- 12#.#.15.28:123
- 14#.##.12.176:24150
- 11#.##4.114.114:53
DNS ASK:
- 60######8a.dontargetme.nl
- 60#######a.websersaiosnginxo.ru
Sends data to the following servers:
- 127.0.0.1:27120
- 127.0.0.1:51130
- 127.0.0.1:51140
- 12#.#.15.28:123
- 127.0.0.1:52760
Receives data from the following servers:
- 127.0.0.1:27120
- 127.0.0.1:51130
- 127.0.0.1:51140
- 12#.#.15.28:123
- 127.0.0.1:52760