Technical Information
Malicious functions:
Manages services:
- ['systemctl', '--quiet', 'is-active', 'multi-user.target']
- ['systemctl', 'start', 'crond.service']
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'quotaoff.service']
Launches processes:
- <SAMPLE_FULL_PATH> \x0a
- basename /usr/sbin/service
- /bin/bash -c /etc/32676&
- /bin/bash -c cd /boot;systemctl daemon-reload;systemctl enable quotaoff.service;systemctl start quotaoff.service;journalctl -xe --no-pager
- /bin/bash /etc/32676
- sleep 60
- /bin/sh /usr/sbin/service crond start
Performs operations with the file system:
Modifies file access rights:
- /etc/opt.services.cfg
- /etc/32676
- /boot/System.mod
Creates or modifies files:
- /etc/.walk
- /etc/opt.services.cfg
- /etc/32676
- /boot/System.mod
- /usr/lib/systemd/system/quotaoff.service
Changes time of creation/access/modification of files:
- /etc/opt.services.cfg
- /boot/System.mod