Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/symcfget
Malicious functions:
Removes itself
Launches processes:
- sh -c echo
Performs operations with the file system:
Creates or modifies files:
- /var/tmp/.config-err
Locks files:
- /var/tmp/.config-err
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
HTTP GET requests:
- wi#####.f3322.net/boot
DNS ASK:
- wi####8.f3322.net
