Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/cron.d/my_process_cron
- /etc/init.d/my_process_service
- /var/spool/cron/crontabs/root
Creates or modifies the following symlinks:
- /etc/rc2.d/S01my_process_service
- /etc/rc3.d/S01my_process_service
- /etc/rc4.d/S01my_process_service
- /etc/rc5.d/S01my_process_service
- /etc/rc0.d/K01my_process_service
- /etc/rc1.d/K01my_process_service
- /etc/rc6.d/K01my_process_service
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- (sd-askpwagent)
- /sbin/init
Performs process tracing:
- swapper/0
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'LOL.service']
- ['systemctl', 'start', '%s.service']
Launches processes:
- /bin/sh -c chmod 644 /etc/cron.d/
- /bin/sh -c systemctl start %s.service
- /bin/sh -c systemctl daemon-reload
- /bin/sh -c crontab /tmp/mycron
- /bin/systemd-tty-ask-password-agent --watch
- chmod 644 /etc/cron.d/
- crontab /tmp/mycron
- /bin/sh -c chmod +x /etc/rc.local
- chmod +x /etc/rc.local
- /usr/bin/perl /usr/sbin/update-rc.d my_process_service defaults
- /bin/sh -c systemctl enable LOL.service
- /bin/sh -c chmod +x /etc/init.d/
- chmod +x /etc/init.d/
- /bin/sh -c update-rc.d my_process_service defaults
Kills the following processes:
- systemd-tty-ask
Performs operations with the file system:
Modifies file access rights:
- /etc/rc.local
- /etc/cron.d
- /etc/init.d
- /var/spool/cron/crontabs/tmp.V2hPuP
Deletes folders:
- /tmp/mycron
Creates or modifies files:
- /etc/systemd/system/LOL.service
- /dev/tty
- /root/.bashrc
- /tmp/mycron
- /var/spool/cron/crontabs/tmp.V2hPuP
Deletes files:
- /tmp/mycron
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:54321
Establishes connection:
- 8.#.8.8:53
- 0.0.0.0:0
Sends data to the following servers:
- 8.#.8.8:53
Receives data from the following servers:
- 8.#.8.8:53