Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/init.d/crontab.sh
- /etc/crontab
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /tmp/.log
Creates folders:
- /tmp/.log
- /tmp/.cache
- /tmp/.crontab
- /var/tmp/.crontab
- /root/.crontab
- /root/.ssh
Creates or modifies files:
- /tmp/.log/<SAMPLE>.log
- /tmp/.cache/cache
- /var/spool/cron/root
- /etc/anacrontab
- /tmp/.log/config.json
Network activity:
Establishes connection:
- 8.#.8.8:53
- [2######c:1401:20f0::1]:9
- 21#.##7.91.145:9
- 21#.##7.91.145:443
- [2#####0c0:8003::154]:9
- [2#####0c0:8002::154]:9
- [2#####0c0:8001::154]:9
- [2#####0c0:8000::154]:9
- 18#.##9.109.133:9
- 18#.##9.108.133:9
- 18#.##9.111.133:9
- 18#.##9.110.133:9
- 18#.##9.109.133:443
- [2######c0:8003::154]:443
- [2######c0:8002::154]:443
- [2######c0:8001::154]:443
- [2######c0:8000::154]:443
Sends data to the following servers:
- 8.#.8.8:53
- 21#.##7.91.145:443
- 18#.##9.109.133:443
Receives data from the following servers:
- 8.#.8.8:53
- 21#.##7.91.145:443
- 18#.##9.109.133:443
Other:
Collects CPU information
Collects information about network activity