Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/knlib
- /etc/cron.d/pwnrig
- /etc/cron.daily/pwnrig
- /etc/cron.hourly/pwnrig
- /etc/cron.monthly/pwnrig
- /etc/cron.weekly/pwnrig
- /etc/cron.d/sediNPFt8
- /etc/cron.daily/sed7nm5J9
- /etc/cron.hourly/sedLSeKZa
- /etc/cron.monthly/sedWh5A87
- /etc/cron.weekly/sedYJpdZa
- /var/spool/cron/crontabs/root
- /etc/cron.d/.lib-knlib4
- /etc/cron.hourly/.lib-knlib4
- /etc/cron.daily/.lib-knlib4
- /etc/cron.weekly/.lib-knlib4
- /etc/cron.monthly/.lib-knlib4
- /etc/init.d/pwnrig
- /etc/init.d/sedJwzhA3
Creates or modifies the following symlinks:
- /etc/rc2.d/S01pwnrig
- /etc/rc3.d/S01pwnrig
- /etc/rc4.d/S01pwnrig
- /etc/rc5.d/S01pwnrig
Malicious functions:
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'knlibe.service']
- ['systemctl', '--quiet', 'enable', 'pwnrig']
- ['systemctl', 'enable', 'pwnrige.service']
- ['systemctl', 'enable', 'pwnrigl.service']
- ['systemctl', 'reload-or-restart', 'pwnrige.service']
Launches processes:
- /usr/bin/mawk awk {print \x22-\x22$2}
- cp -f -r -- /bin/knlib /bin/klibsystem5
- sed -i 1 s/-e // /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
- hostname
- /usr/bin/perl /usr/sbin/update-rc.d -f pwnrig disable
- chattr +ia /etc/init.d/knlib
- rm -rf /bin/bprofr
- bash -c ufw disable
- bash -c echo \x22* * * * * /opt/.klibsystem5 >/dev/null 2>&1\x22 | crontab -
- cut -d: -f2
- chattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
- crontab -r
- rm -rf /bin/crondr
- chattr +ia /etc/cron.daily/.lib-knlib4
- grep -c ^processor /proc/cpuinfo
- /bin/bash /etc/init.d/knlib start
- grep /etc/cron
- /usr/bin/mawk awk {print $1}
- chattr +i +a /bin/bprofr /root/.bash_profile
- /tmp/-bash -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
- nohup ./klibsystem5
- <0x25f>
- cp -f -r -- /tmp/-bash /bin/bprofr
- sed -e s/^ *//
- sed -i 1 s/-e // /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
- /usr/bin/pgrep pkill -f .klibsystem4
- chattr +ia /etc/cron.d/.lib-knlib4
- pgrep -f klibsystem4
- chattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
- whoami
- cp -f -r -- /tmp/-bash /bin/crondr
- /usr/bin/perl /usr/sbin/update-rc.d pwnrig enable
- mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
- /bin/sh /usr/bin/which systemctl
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- chattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr
- chattr +ia /var/spool/cron/.lib-knlib4
- rm -rf /bin/initdr
- chattr -i -a /bin/bprofr /root/.bash_profile
- chattr +ia /etc/cron.monthly/.lib-knlib4
- chattr +ia /bin/knlib
- tee /etc/init.d/pwnrig
- chattr +ia /root/.bash_profile
- hostname -I
- grep Port
- chattr +i +a /etc/init.d/pwnrig /bin/initdr
- chattr -i -a /etc/cron.*/pwnrig /bin/crondr
- /usr/bin/perl /usr/sbin/update-rc.d pwnrig defaults
- /tmp/-python3
- /bin/sh /usr/bin/which update-rc.d
- chattr -i -a /etc/init.d/pwnrig /bin/initdr
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- sed -i 1 s/-e // /etc/init.d/pwnrig
- <0x186>
- tee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
- chattr +ia /etc/cron.hourly/.lib-knlib4
- id -u
- rm -rf -- klibsystem5
- sed -i /bprofr/d /root/.bash_profile
- head -n 1
- pgrep -f klibsystem5
- grep -m 1 model name /proc/cpuinfo
- rm -rf /bin/sysdr
- sed -e s/$//
- cp -f -r -- /tmp/-bash /bin/initdr
- tee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service
- chattr +ia /etc/anacrontab
- cp -f -r -- /tmp/-bash /bin/sysdr
- crontab -
- chmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
- /usr/bin/perl /usr/sbin/update-rc.d -f pwnrig remove
- chattr +ia /etc/cron.weekly/.lib-knlib4
- chmod +x /etc/init.d/pwnrig /bin/initdr
- ps -A -ostat,ppid
- /bin/sh /usr/bin/which chkconfig
- grep -v grep
- cat /etc/ssh/sshd_config
- chattr +ia /etc/systemd/system/knlibe.service
- ps x
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/knlib
- /usr/bin/knlib
- /etc/cron.d/pwnrig
- /etc/cron.daily/pwnrig
- /etc/cron.hourly/pwnrig
- /etc/cron.monthly/pwnrig
- /etc/cron.weekly/pwnrig
- /usr/bin/crondr
- /var/spool/cron/crontabs/tmp.eQQIn8
- /etc/init.d/pwnrig
- /usr/bin/initdr
Modifies file owner:
- /root/sed4ZKmdm
- /etc/cron.d/sediNPFt8
- /etc/cron.daily/sed7nm5J9
- /etc/cron.hourly/sedLSeKZa
- /etc/cron.monthly/sedWh5A87
- /etc/cron.weekly/sedYJpdZa
- /etc/init.d/sedJwzhA3
- /usr/lib/systemd/system/sedKtIC61
- /etc/systemd/system/sed9DCIE2
Creates or modifies files:
- /tmp/-python3
- /tmp/.bashirc
- /tmp/-bash
- /etc/systemd/system/knlibe.service
- /root/.bash_profile
- /usr/bin/knlib
- /root/sed4ZKmdm
- /usr/bin/bprofr
- /usr/bin/crondr
- /opt/.klibsystem5
- /var/spool/cron/crontabs/tmp.eQQIn8
- /var/spool/cron/.lib-knlib4
- /etc/anacrontab
- /usr/bin/initdr
- /usr/bin/sysdr
- /usr/lib/systemd/system/pwnrigl.service
- /etc/systemd/system/pwnrige.service
- /usr/lib/systemd/system/sedKtIC61
- /etc/systemd/system/sed9DCIE2
Deletes files:
- /tmp/-python3
- /root/sed4ZKmdm
Locks files:
- /tmp/.bashirc
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:59475
- 127.0.0.1:6060
Establishes connection:
- 127.0.0.1:9
- [:#1]:9
- 8.#.8.8:53
- 5.##.80.215:80
- 80.##.24.30:80
- 80.##.24.30:443
- 51.###.171.23:80
- 51.###.171.23:443
DNS ASK:
- ru#.#ck-dns.ws
- c4####cd.pwndns.pw
- http
Sends data to the following servers:
- 5.##.80.215:80
- 80.##.24.30:80
- 51.###.171.23:80
Receives data from the following servers:
- 5.##.80.215:80
- 80.##.24.30:80
- 51.###.171.23:80
Other:
Collects OS information
Collects CPU information
Collects RAM information