Technical Information
Malicious functions:
Substitutes application name for:
- (sd-askpwagent)
Manages services:
- ['systemctl', 'restart', 'exim.service']
Launches processes:
- <0x1b>
- tail -1
- <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
- clear
- du -ch
- sleep 3
- touch /home//logs/php-fpm.log
- chown -R mysql:mysql /home//logs/mysql*
- rm -rf /var/log/secure
- rm -rf /var/log/nginx/error.log
- rm -rf /home//private_html/server-log/*.*
- touch /home//logs/php-fpm-slow.log
- touch /var/log/secure
- cat /etc/dlemp/.tmp/dlemp-checkeximlogzise
- touch /var/log/nginx/error.log
- rm -rf /home//logs/*
- chmod -R 600 /var/log/secure
- touch /home//logs/mysql.log
- rm -rf /var/log/exim/*
- rm -rf /etc/dlemp/.tmp/dlemp-check*
- cut -f 1
- rm -rf /etc/dlemp/.tmp/checksizelog
- chown -R nginx:nginx /var/log/nginx/error.log
- chown -R nginx:nginx /home//logs/php-fpm*
- touch /home//logs/mysql-slow.log
Kills the following processes:
- systemctl
Performs operations with the file system:
Modifies file access rights:
- /var/log/secure
Creates or modifies files:
- /etc/dlemp/.tmp/dlemp-checklogzise
- /etc/dlemp/.tmp/dlemp-checkeximlogzise
- /var/log/nginx/error.log
- /home//logs/php-fpm.log
- /home//logs/php-fpm-slow.log
- /home//logs/mysql.log
- /home//logs/mysql-slow.log
- /var/log/secure
Changes time of creation/access/modification of files:
- /var/log/nginx/error.log
- /home//logs/php-fpm.log
- /home//logs/php-fpm-slow.log
- /home//logs/mysql.log
- /home//logs/mysql-slow.log
- /var/log/secure