Technical Information
Malicious functions:
Removes itself
Gains root privileges
Launches itself as a daemon
Substitutes application name for:
- (null)
Launches processes:
- netstat -nlp | grep \x27:22 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
- grep :111
- netstat -nlp
- grep :40326
- /usr/bin/mawk awk -F: {print $NF}
- pgrep -o .
- cut -d/ -f1
- grep :50801
- netstat -nlp | grep \x27:111 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
- sort -u
- /usr/bin/mawk awk /^tcp/ {print $4}
- netstat -nlp | grep \x27:25 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
- netstat -nlp | grep \x27:40326 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
- netstat -nlp | grep \x27:50801 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
- grep :22
- grep :25
- /usr/bin/mawk awk {print $7}
- netstat -nlp | awk \x27/^tcp/ {print $4}\x27 | awk -F\x27:\x27 \x27{print $NF}\x27 | sort -u
Kills system processes:
- sshd
Kills the following processes:
- rpcbind
- exim4
- rpc.statd
- systemd
Performs operations with the file system:
Deletes folders:
- /null
- /xconsole
- /var/log/syslog
- /var/log/daemon.log
- /0
Creates or modifies files:
- /etc/resolv.conf
- /dev/pts/0
Deletes files:
- /null
- /xconsole
- /var/log/syslog
- /var/log/daemon.log
- /0
Network activity:
Establishes connection:
- 8.#.8.8:53
- 17#.##.210.229:1440
Sends data to the following servers:
- 17#.##.210.229:1440
Receives data from the following servers:
- 17#.##.210.229:1440
Other:
Collects CPU information
Collects RAM information
