Technical Information
Malicious functions:
Substitutes application name for:
- tokio-runtime-worker
- log flusher
- sled-io-3
- sled-io-4
- sled-io-5
- sled-io-6
- sled-io-2
- sled-io-1
- sled-io-0
Launches processes:
- /usr/bin/perl /usr/bin/open http://localhost:12345
- file -b --mime-type -e tokens -L -z http://localhost:12345
- /bin/sh /usr/bin/which file
Performs operations with the file system:
Modifies file owner:
- /root/.config/OxidizeBot/oxidize.sql-journal
Creates folders:
- /root/.config
- /root/.config/OxidizeBot
- /root/.config/OxidizeBot/storage
- /root/.config/OxidizeBot/storage/sled.34
- /root/.config/OxidizeBot/storage/sled.34/blobs
Creates or modifies files:
- /root/.config/OxidizeBot/oxidize.log
- /root/.config/OxidizeBot/oxidize.sql
- /root/.config/OxidizeBot/oxidize.sql-journal
- /root/.config/OxidizeBot/storage/sled.34/conf
- /root/.config/OxidizeBot/storage/sled.34/db
Deletes files:
- /root/.config/OxidizeBot/oxidize.sql-journal
Locks files:
- /root/.config/OxidizeBot/storage/sled.34/db
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:12345
Establishes connection:
- 8.#.8.8:53
- 17#.##.129.220:0
- (e##val)
- 10#.#1.1.192:0
- [2#######0:3036::ac43:81dc]:0
- [2#######0:3036::6815:1c0]:0
- 17#.##.129.220:443
- 14#.##.121.6:443
- 10#.##.1.192:443
DNS ASK:
- se##ac.tv
- ap#.#ithub.com
Sends data to the following servers:
- 17#.##.129.220:443
- 10#.##.1.192:443
- 14#.##.121.6:443
Receives data from the following servers:
- 17#.##.129.220:443
- 10#.##.1.192:443
- 14#.##.121.6:443
Other:
Collects CPU information