Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /tmp/.ICECache /usr/libexec/rpciod
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- <SAMPLE_FULL_PATH>
- /tmp/.ICECache
- /usr/bin/id
- /usr/bin/ls
- /usr/bin/dash
Creates or modifies files:
- <SAMPLE_FULL_PATH>
- /tmp/.ICECache
Deletes files:
- <SAMPLE_FULL_PATH>
- /tmp/.ICECache
Changes time of creation/access/modification of files:
- <SAMPLE_FULL_PATH>
- /bin/id
- /bin/ls
- /bin/sh