Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches processes:
- /usr/bin/bash -c hostnamectl
- hostnamectl
- /usr/bin/bash -c printenv
- /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B 1
- cp /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B
- /usr/bin/bash -c echo \x22@reboot /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B\x22 | crontab -
- crontab -
- <SAMPLE_FULL_PATH> 685
- /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B
- printenv
- <SAMPLE_FULL_PATH> 1
- /usr/bin/bash -c cp /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B
Performs operations with the file system:
Modifies file access rights:
- /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B
- /var/spool/cron/crontabs/tmp.WtfmFw
Creates folders:
- /root/.local
- /root/.local/share
Creates or modifies files:
- /root/.local/share/.m2DoZgBUxLcR70xijNW9V999B
- /root/.local/share/.OMkFNCoLNGbxVqas76vtrJAZi
- /var/spool/cron/crontabs/tmp.WtfmFw
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- 8.#.8.8:53
- 34.###.186.192:443
- [2#########2:0:466:39ff:fe7f:1826]:9
- [2######9:c010:19eb::1]:9
- [2#########2:0:466:39ff:fe32:e3dd]:9
- [2#########ff0:4f:266:37ff:fe2c:5d19]:9
- [2#########ff0:4f:266:37ff:feae:3bbc]:9
- 11#.##2.120.165:9
- 95.##6.163.36:9
- 20#.#.99.144:9
- 11#.##2.120.166:9
- 20#.#.99.146:9
- 11#.##2.120.165:443
- 20#.#.99.146:443
Sends data to the following servers:
- 8.#.8.8:53
- 34.###.186.192:443
- 11#.##2.120.165:443
- 20#.#.99.146:443
Receives data from the following servers:
- 8.#.8.8:53
- 34.###.186.192:443
- 11#.##2.120.165:443
- 20#.#.99.146:443
Other:
Collects CPU information