Technical Information
Malicious functions:
Launches itself as a daemon
Manages services:
- ['systemctl', 'enable', 'ssl-key']
Launches processes:
- grep network.proxy.ssl
- cat /etc/profile | grep https_proxy
- cat /root/.mozilla/firefox/*release/prefs.js
- cat /root/.mozilla/firefox/*default/prefs.js
- cat $HOME/.mozilla/firefox/*release/prefs.js | grep network.proxy.ssl
- grep https_proxy
- cat $HOME/.mozilla/firefox/*default/prefs.js | grep network.proxy.ssl
- systemctl enable ssl-key >/dev/null 2>/dev/null
- cat /etc/profile
Performs operations with the file system:
Creates folders:
- /root/.config
- /root/.config/autostart
Creates or modifies files:
- <SAMPLE_FULL_PATH>
- /usr/lib/systemd/system/ssl-key.service
Network activity:
Establishes connection:
- 20#.##9.95.7:443
- 17#.##2.59.191:443
- 14#.##.250.144:443