Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dpkg-deb-package
- /etc/cron.d/dbus-manager
- /etc/cron.hourly/dbus-manager
- /etc/cron.daily/dbus-manager
- /etc/cron.weekly/dbus-manager
- /etc/cron.monthly/dbus-manager
Malicious functions:
Launches itself as a daemon
Launches processes:
- ps -A -ostat,ppid
- /usr/bin/mawk awk {print $1}
- ps aux
- chattr -ia /etc/cron.weekly/.placeholder
- head -n 1
- whoami
- grep /etc/cron
- grep -v /usr/sbin/httpd
- <0x1ba>
- chattr -ia /etc/cron.daily/logrotate
- /tmp/-python37-3a69411b-ab7a-42ba-92f3-3db2477bc8d3 /tmp/-python37-3a69411b-ab7a-42ba-92f3-3db2477bc8d3
- hostname -I
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- grep -v grep
- chattr -ia /etc/cron.daily/dpkg
- cat /etc/ssh/sshd_config
- sed -e s/$//
- bash -c find /usr -type f -regextype egrep -regex \x27.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\x27 -exec rm -rf {} +
- chattr -ia /etc/cron.d/e2scrub_all
- chattr -ia /etc/cron.weekly/man-db
- chattr -ia /etc/cron.daily/apt-compat
- /usr/bin/mawk awk {print \x22-\x22$2}
- grep -v -- -bash[[:space:]]*$
- grep -- -bash[[:space:]]*$
- cut -d: -f2
- /tmp/4d8dfeb5-e506-44f3-a0fc-30dd0bd5ac0d kworker/R-debug
- grep -c ^processor /proc/cpuinfo
- id -u
- hostname
- chattr -ia /etc/cron.monthly/.placeholder
- chattr -ia /etc/cron.hourly/.placeholder
- grep -m 1 model name /proc/cpuinfo
- chattr -ia /etc/cron.daily/.placeholder
- grep Port
- chattr -ia /var/spool/cron/crontabs
- wc -l
- <0x90>
- find /usr -type f -regextype egrep -regex .*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12} -exec rm -rf {} +
- /tmp/-bash-3a69411b-ab7a-42ba-92f3-3db2477bc8d3 /tmp/-bash-3a69411b-ab7a-42ba-92f3-3db2477bc8d3 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
- ps x
- /usr/bin/mawk awk {if($3>30.0) print $2}
- chattr -ia /etc/cron.daily/man-db
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- chattr -ia /etc/cron.d/.placeholder
- sed -e s/^ *//
- <0x14c>
Kills the following processes:
- ps
Performs operations with the file system:
Modifies file access rights:
- /tmp/4d8dfeb5-e506-44f3-a0fc-30dd0bd5ac0d
- /etc/init.d/dpkg-deb-package
- /usr/bin/dpkg-debian
Deletes folders:
- /var/spool/cron/crontabs
Creates or modifies files:
- /tmp/4d8dfeb5-e506-44f3-a0fc-30dd0bd5ac0d
- /tmp/cbae10f9-e86b-4398-899e-e6f55fa60671
- /etc/systemd/system/dpkg-deb-package.service
- /usr/bin/dpkg-debian
- /tmp/-bash-3a69411b-ab7a-42ba-92f3-3db2477bc8d3
- /var/spool/cron/dbus-manager
- /tmp/.lock
- /tmp/-python37-3a69411b-ab7a-42ba-92f3-3db2477bc8d3
- /tmp/.bashirc
Deletes files:
- /etc/cron.d/.placeholder
- /etc/cron.d/e2scrub_all
- /var/spool/cron/crontabs
- /etc/cron.hourly/.placeholder
- /etc/cron.daily/.placeholder
- /etc/cron.daily/apt-compat
- /etc/cron.daily/dpkg
- /etc/cron.daily/logrotate
- /etc/cron.daily/man-db
- /etc/cron.weekly/.placeholder
- /etc/cron.weekly/man-db
- /etc/cron.monthly/.placeholder
- /tmp/-bash-3a69411b-ab7a-42ba-92f3-3db2477bc8d3
- /tmp/-python37-3a69411b-ab7a-42ba-92f3-3db2477bc8d3
Locks files:
- /tmp/.lock
- /tmp/.bashirc
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:10444
Establishes connection:
- 16#.##.162.175:80
- 80.##.24.30:80
DNS ASK:
- ru#.##-demand.pw
- c4####cd.pwndns.pw
Sends data to the following servers:
- 16#.##.162.175:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
