Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Operates the following kernel modules:
- vmdevx
Launches processes:
- /usr/sbin/xtables-nft-multi iptables -t nat -A XFILTER -p tcp -j REDIRECT --to-port 57590
- /usr/sbin/xtables-nft-multi iptables -t nat -F XFILTER
- iptables -I INPUT -p tcp --dport 57590 -j ACCEPT 2>&1
- /usr/sbin/xtables-nft-multi iptables -t nat -A PREROUTING -p tcp --sport 45535 -m recent --set --name ipxles --rsource -j ACCEPT
- iptables -t nat -D PREROUTING -p tcp --sport 45535 -m recent --set --name ipxles --rsource -j ACCEPT 2>&1
- iptables -t nat -A XFILTER -p tcp -j REDIRECT --to-port 57590 2>&1
- iptables -t nat -N XFILTER 2>&1
- /usr/sbin/xtables-nft-multi iptables -t nat -D PREROUTING -p tcp --sport 45535 -m recent --set --name ipxles --rsource -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -I INPUT -p tcp --dport 57590 -j ACCEPT
- iptables -t nat -X XFILTER 2>&1
- iptables -t nat -A PREROUTING -p tcp --sport 45535 -m recent --set --name ipxles --rsource -j ACCEPT 2>&1
- iptables -t nat -D PREROUTING -p tcp --dport 8443 --syn -m recent --rcheck --seconds 300 --name ipxles --rsource -j XFILTER 2>&1
- /usr/sbin/xtables-nft-multi iptables -t nat -N XFILTER
- iptables -t nat -A PREROUTING -p tcp --dport 8443 --syn -m recent --rcheck --seconds 300 --name ipxles --rsource -j XFILTER 2>&1
- mkdir /bin/mewiwje
- iptables -D INPUT -p tcp --dport 57590 -j ACCEPT 2>&1
- mv <SAMPLE_FULL_PATH> /bin/mewiwje
- iptables -t nat -F XFILTER 2>&1
- /usr/sbin/xtables-nft-multi iptables -t nat -X XFILTER
- /usr/sbin/xtables-nft-multi iptables -t nat -A PREROUTING -p tcp --dport 8443 --syn -m recent --rcheck --seconds 300 --name ipxles --rsource -j XFILTER
- /usr/sbin/xtables-nft-multi iptables -t nat -D PREROUTING -p tcp --dport 8443 --syn -m recent --rcheck --seconds 300 --name ipxles --rsource -j XFILTER
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --dport 57590 -j ACCEPT
Kills the following processes:
- dash
Performs operations with the file system:
Modifies file access rights:
- /etc/rc.local
Creates folders:
- /usr/bin/mewiwje
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:57590