Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- pyi
Modifies firewall settings:
- iptables -F
Launches processes:
- sh -c rm -rf /tmp/*
- rm -rf /tmp/*
- sh -c iptables -F
- sh -c pkill -9 busybox
- pkill -9 busybox
- sh -c pkill -9 perl
- pkill -9 perl
- sh -c pkill -9 python
- pkill -9 python
- sh -c rm -rf ~/.bash_history
- rm -rf /root/.bash_history
- sh -c history -c
Performs operations with the file system:
Creates or modifies files:
- /etc/resolv.conf
Deletes files:
- /tmp/*
- /root/.bash_history
Network activity:
Establishes connection:
- 8.#.8.8:53
- 51.##.18.88:45
Sends data to the following servers:
- 51.##.18.88:45
Receives data from the following servers:
- 51.##.18.88:45
Other:
Collects CPU information
