Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
- ['systemctl', 'enable', 'ssl-key']
Launches processes:
- cat /root/.mozilla/firefox/*default/prefs.js
- cat /proc/scsi/scsi | grep -i -E \x27VMWare|VirtualBox\x27
- cat $HOME/.mozilla/firefox/*default/prefs.js | grep network.proxy.ssl
- /tmp/main >/dev/null 2>/dev/null
- grep -i -E VMWare|VirtualBox
- cat /root/.mozilla/firefox/*release/prefs.js
- systemctl enable ssl-key >/dev/null 2>/dev/null
- cat /proc/scsi/scsi
- cat /etc/profile
- grep network.proxy.ssl
- grep https_proxy
- /tmp/main
- cat $HOME/.mozilla/firefox/*release/prefs.js | grep network.proxy.ssl
- cat /etc/profile | grep https_proxy
Performs operations with the file system:
Creates folders:
- /root/.config
- /root/.config/autostart
Creates symlinks:
- /sem.debianV1.0
Creates or modifies files:
- /tmp/main
- /dev/shm/bnMtwI
- /usr/lib/systemd/system/ssl-key.service
Deletes files:
- /bnMtwI
Network activity:
Establishes connection:
- 8.#.8.8:53
- 127.0.0.1:443
- 45.###.155.110:443
DNS ASK:
- ap#######.firewall-gateway.de
- ap#####te.my-router.de