Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.d/init.d/tcp4
- /etc/rc.local
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Replaces the following system files:
- /usr/bin/wget
- /usr/bin/lsof
Manages services:
- ['systemctl', 'daemon-reload', 'redis.service']
- ['systemctl', 'enable ', 'redis.service']
- ['systemctl', 'daemon-reload', 'mysql.service']
- ['systemctl', 'enable ', 'mysql.service']
Launches processes:
- mv /usr/bin/lsof /usr/bin/.lsof
- mv /usr/bin/awk /usr/bin/.awk
- mv /usr/bin/man /usr/bin/.man
- mv /usr/bin/top /usr/bin/.top
- mv /usr/bin/find /usr/bin/.find
- mv /usr/bin/ssh /usr/bin/.ssh
- mv /usr/bin/du /usr/bin/.du
- mount -o bind /var /proc/830/
- mv /usr/bin/wc /usr/bin/.wc
- mv /usr/bin/tail /usr/bin/.tail
- <SAMPLE_FULL_PATH> e
- mv /usr/bin/sudo /usr/bin/.sudo
- mv /usr/bin/wget /usr/bin/.wget
- mv /usr/bin/head /usr/bin/.head
- crontab /var/.recovery
- <SAMPLE_FULL_PATH> d
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.p5rKbb
Creates folders:
- /var/web
Creates or modifies files:
- /var/temp_check_permissions
- /usr/bin/sudo
- /run/mount/utab
- /dev/watchdog
- /etc/default_dns.conf
- /tmp/.system
- /opt/cgo
- /var/kernal
- /usr/bin/top
- /usr/bin/find
- /lib/readdir.so
- /var/.recovery
- /var/web/media.jpg
- /etc/systemd/system/redis.service
- /usr/bin/ssh
- /var/spool/cron/crontabs/tmp.p5rKbb
- /usr/bin/wget
- /usr/bin/head
- /etc/systemd/system/mysql.service
- /usr/bin/tail
- /usr/bin/awk
- /usr/bin/man
- /usr/bin/wc
- /usr/bin/du
- /usr/bin/lsof
Deletes files:
- /var/temp_check_permissions
Mounts file systems:
- /var
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- 20#.##1.36.137:9090
Other:
Collects CPU information