Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/faxfg31e08b5tv9.00991 card0-crtc0
- crontab -r
- crontab -
- /bin/bash -c crontab -l
- /bin/sh -c crontab -l
- /bin/bash -c crontab -r
- crontab -l
- /bin/bash -c (crontab -l 2>/dev/null; echo \x22*/2 * * * * /var/log/journal/ad37c59686df4d448d36e2f09341ba66/lf9luf5916gv\x22) | crontab -
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.WrZLES
- /etc/profile
- /root/.profile
- /root/.bashrc
Creates or modifies files:
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/faxfg31e08b5tv9.00991
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/config.json
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/lf9luf5916gv
- /var/spool/cron/crontabs/tmp.WrZLES
- /etc/profile
- /root/.profile
- /root/.bashrc
- /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
Deletes files:
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/faxfg31e08b5tv9.00991
- /var/log/journal/ad37c59686df4d448d36e2f09341ba66/config.json
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:65118
- 127.0.0.1:64225
Establishes connection:
- 127.0.0.1:64225
- 127.0.0.1:65118
- 127.0.0.1:64786
- 8.#.8.8:53
- [2######50:4010:c0b::c7]:9
- 17#.##4.222.199:9
- 17#.##4.222.199:443
- 5.###.137.200:9
- 37.###.243.102:9
Sends data to the following servers:
- 8.#.8.8:53
- 17#.##4.222.199:443
Receives data from the following servers:
- 8.#.8.8:53
- 17#.##4.222.199:443
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
