Technical Information
Malicious functions:
Operates the following kernel modules:
Launches processes:
- /bin/kill -62 0
- /usr/bin/kmod /sbin/insmod /tmp/.ijzytgih1146206044
- /tmp/.ttabitpztsklpwestd2788457712
- /usr/bin/kmod /sbin/lsmod
Kills the following processes:
- swapper/0
Performs operations with the file system:
Modifies file access rights:
- /tmp/.ttabitpztsklpwestd2788457712
Creates or modifies files:
- /tmp/.vtstcodnxq2258294132
- /tmp/.ttabitpztsklpwestd2788457712
- /tmp/.ijzytgih1146206044
Deletes files:
- /tmp/.vtstcodnxq2258294132
- /tmp/.ttabitpztsklpwestd2788457712
- /tmp/.ijzytgih1146206044
Network activity:
Establishes connection:
- 8.#.8.8:53
- [2#######0:310c::ac42:2fb5]:9
- [2#######0:310c::ac42:2c4b]:9
- 17#.#6.47.181:9
- 17#.#6.44.75:9
- 17#.##.47.181:443
- [2#####8c1:3121::9]:9
- [2#####8c1:3120::9]:9
- [2#########90:0:f22e:fbec:5bed:a9b9]:9
- 17#.#5.251.78:9
- 17#.##.251.78:443
- 10#.##0.15.214:80
DNS ASK:
- df####ds.pages.dev
- gi##ab.com
Sends data to the following servers:
- 17#.##.47.181:443
- 17#.##.251.78:443
- 10#.##0.15.214:80
Receives data from the following servers:
- 17#.##.47.181:443
- 17#.##.251.78:443
- 10#.##0.15.214:80
Other:
Collects OS information
Collects CPU information