Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/qemu-guest-agent
- /etc/init.d/apparmor
- /etc/init.d/cron
- /etc/init.d/networking
- /etc/init.d/keyboard-setup.sh
- /etc/init.d/kmod
- /etc/init.d/hwclock.sh
- /etc/init.d/console-setup.sh
- /etc/init.d/udev
- /etc/init.d/sudo
- /etc/init.d/procps
- /etc/init.d/ssh
- /etc/init.d/dbus
- /etc/init.d/rsyslog
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/sh -c /usr/bin/lsof132ff
- /dev/shm/agetty
- /usr/bin/lsof132ff
- /bin/sh -c /dev/shm/agetty
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/lsof132ff
- /dev/shm/agetty
- /usr/bin/osld123ff
Creates or modifies files:
- /usr/bin/lsof132ff
- /dev/shm/agetty
- /var/tmp/.tk.pid
- /usr/bin/osld123ff
Deletes files:
- /agetty
Locks files:
- /var/tmp/.tk.pid
Changes time of creation/access/modification of files:
- /usr/bin/lsof132ff
- /usr/bin/osld123ff
Network activity:
Establishes connection:
- 47.##.69.178:443