Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/rek
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K02exim4
- /etc/rc0.d/K08umountfs
- /etc/rc0.d/K05umountnfs.sh
- /etc/rc0.d/K03sendsigs
- /etc/rc0.d/K04rsyslog
- /etc/rc0.d/K07networking
- /etc/rc0.d/K07hwclock.sh
- /etc/rc0.d/K06rpcbind
- /etc/rc0.d/K10halt
- /etc/rc0.d/K09umountroot
- /etc/rc0.d/K06nfs-common
- /etc/rc0.d/K01rek
- /etc/rc1.d/K02exim4
- /etc/rc1.d/K04rsyslog
- /etc/rc1.d/K06rpcbind
- /etc/rc1.d/K06nfs-common
- /etc/rc1.d/K01rek
- /etc/rc2.d/S02rek
- /etc/rc3.d/S02rek
- /etc/rc4.d/S02rek
- /etc/rc5.d/S02rek
- /etc/rc6.d/K02exim4
- /etc/rc6.d/K08umountfs
- /etc/rc6.d/K05umountnfs.sh
- /etc/rc6.d/K03sendsigs
- /etc/rc6.d/K04rsyslog
- /etc/rc6.d/K07networking
- /etc/rc6.d/K07hwclock.sh
- /etc/rc6.d/K06rpcbind
- /etc/rc6.d/K09umountroot
- /etc/rc6.d/K10reboot
- /etc/rc6.d/K06nfs-common
- /etc/rc6.d/K01rek
Malicious functions:
Substitutes application name for:
- 68a44u3423a4u84a9aaa8844
Manages services:
- update-rc.d rek defaults
- systemctl daemon-reload
Launches processes:
- sh -c mv yama.* /etc; mv /etc/yama.* /etc/ocd; echo -e '#!/bin/bas
- mv yama.* /etc
- mv /etc/yama.* /etc/ocd
- chmod +x /etc/init.d/rek
- /sbin/insserv rek
- rm -rf .bash_history
- rm -rf /root/.bash_history
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/rek
Deletes files:
- /etc/rc0.d/K01exim4
- /etc/rc0.d/K07umountfs
- /etc/rc0.d/K04umountnfs.sh
- /etc/rc0.d/K02sendsigs
- /etc/rc0.d/K03rsyslog
- /etc/rc0.d/K06networking
- /etc/rc0.d/K06hwclock.sh
- /etc/rc0.d/K05rpcbind
- /etc/rc0.d/K09halt
- /etc/rc0.d/K08umountroot
- /etc/rc0.d/K05nfs-common
- /etc/rc1.d/K01exim4
- /etc/rc1.d/K03rsyslog
- /etc/rc1.d/K05rpcbind
- /etc/rc1.d/K05nfs-common
- /etc/rc6.d/K01exim4
- /etc/rc6.d/K07umountfs
- /etc/rc6.d/K04umountnfs.sh
- /etc/rc6.d/K02sendsigs
- /etc/rc6.d/K03rsyslog
- /etc/rc6.d/K06networking
- /etc/rc6.d/K06hwclock.sh
- /etc/rc6.d/K05rpcbind
- /etc/rc6.d/K08umountroot
- /etc/rc6.d/K09reboot
- /etc/rc6.d/K05nfs-common
- /root/.bash_history
Network activity:
Establishes connection:
- 8.#.8.8:53
