Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c ulimit -HSn 65536
- sed -e s/.*:[^0-9]//
- grep cpu MHz
- cat /proc/cpuinfo
Performs operations with the file system:
Creates or modifies files:
- /etc/sysctl.conf
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:47895
Establishes connection:
- 12#.##.181.207:19370
- 12#.##.181.207:6662
Sends data to the following servers:
- 12#.##.181.207:19370
Other:
Collects CPU information
Collects information about network activity
