Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- crontab -l
- /bin/bash -c crontab -l
Performs operations with the file system:
Deletes folders:
- /etc/cron.d
- /etc/dbus-1
- /etc/docker
- /etc/grub.d
- /etc/init.d
- /etc/kernel
Deletes files:
- /etc/cron.d
- /etc/dbus-1
- /etc/docker
- /etc/group-
- /etc/grub.d
- /etc/init.d
- /etc/kernel
- /etc/nanorc
- /etc/passwd
- /etc/shadow
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:50777
Establishes connection:
- 127.0.0.1:50777
- 127.0.0.1:58005
- 8.#.8.8:53
Other:
Collects CPU information
Collects information about network activity