Technical Information
Malicious functions:
Launches itself as a daemon
Manages services:
- ['systemctl', 'enable', 'ssl-key']
Launches processes:
- cat /root/.mozilla/firefox/*default/prefs.js
- cat /etc/profile | grep https_proxy
- grep https_proxy
- cat $HOME/.mozilla/firefox/*release/prefs.js | grep network.proxy.ssl
- cat $HOME/.mozilla/firefox/*default/prefs.js | grep network.proxy.ssl
- systemctl enable ssl-key >/dev/null 2>/dev/null
- grep network.proxy.ssl
- cat /etc/profile
- cat /root/.mozilla/firefox/*release/prefs.js
Performs operations with the file system:
Creates folders:
- /root/.config
- /root/.config/autostart
Creates or modifies files:
- <SAMPLE_FULL_PATH>
- /usr/lib/systemd/system/ssl-key.service
Network activity:
Establishes connection:
- 8.#.8.8:53
- 45.###.155.113:443
DNS ASK:
- ap#####ort.my-router.de