Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/DbSecuritySpt
- /etc/init.d/selinux
- /etc/rc1.d/S97DbSecuritySpt
- /etc/rc2.d/S97DbSecuritySpt
- /etc/rc3.d/S97DbSecuritySpt
- /etc/rc4.d/S97DbSecuritySpt
- /etc/rc5.d/S97DbSecuritySpt
- /etc/rc1.d/S99selinux
- /etc/rc2.d/S99selinux
- /etc/rc3.d/S99selinux
- /etc/rc4.d/S99selinux
- /etc/rc5.d/S99selinux
- /etc/cron.d/tomcat
- /etc/rc.d/init.d/watchdogs
- /etc/rc.d/init.d/kthrotlds
- /etc/init.d/netdns
Malicious functions:
Launches processes:
- /usr/bin/getconf CLK_TCK
- chattr -i /etc/cfly
- chattr +i /etc/cfly
- chattr -i /etc/migrations
- chattr +i /etc/migrations
- chattr -i /etc/httpdz
- chattr +i /etc/httpdz
- chattr -i /opt/nu/renice
- chattr +i /opt/nu/renice
- chattr -i /opt/yilu/mservice
- chattr +i /opt/yilu/mservice
- chattr -i /opt/yilu/work/xig/xig
- chattr +i /opt/yilu/work/xig/xig
- chattr -i /opt/yilu/work/xige/xige
- chattr +i /opt/yilu/work/xige/xige
- chattr -i /tmp/thisxxs
- chattr +i /tmp/thisxxs
- chattr -i /usr/bin/.sshd
- chattr +i /usr/bin/.sshd
- chattr -i /usr/bin/bsd-port/getty
- chattr +i /usr/bin/bsd-port/getty
- chattr -i /usr/bin/bsd-port/.dbus
- chattr +i /usr/bin/bsd-port/.dbus
- chattr -i /usr/bin/bsd-port/nmi
- chattr +i /usr/bin/bsd-port/nmi
- chattr -i /tmp/php
- chattr +i /tmp/php
- chattr -i /tmp/name
- chattr +i /tmp/name
- chattr -i /tmp/xc.x86_64
- chattr +i /tmp/xc.x86_64
- chattr -i /etc/init.d/DbSecuritySpt
- chattr +i /etc/init.d/DbSecuritySpt
- chattr -i /etc/init.d/selinux
- chattr +i /etc/init.d/selinux
- chattr -i /etc/rc1.d/S97DbSecuritySpt
- chattr +i /etc/rc1.d/S97DbSecuritySpt
- chattr -i /etc/rc2.d/S97DbSecuritySpt
- chattr +i /etc/rc2.d/S97DbSecuritySpt
- chattr -i /etc/rc3.d/S97DbSecuritySpt
- chattr +i /etc/rc3.d/S97DbSecuritySpt
- chattr -i /etc/rc4.d/S97DbSecuritySpt
- chattr +i /etc/rc4.d/S97DbSecuritySpt
- chattr -i /etc/rc5.d/S97DbSecuritySpt
- chattr +i /etc/rc5.d/S97DbSecuritySpt
- chattr -i /etc/rc1.d/S99selinux
- chattr +i /etc/rc1.d/S99selinux
- chattr -i /etc/rc2.d/S99selinux
- chattr +i /etc/rc2.d/S99selinux
- chattr -i /etc/rc3.d/S99selinux
- chattr +i /etc/rc3.d/S99selinux
- chattr -i /etc/rc4.d/S99selinux
- chattr +i /etc/rc4.d/S99selinux
- chattr -i /etc/rc5.d/S99selinux
- chattr +i /etc/rc5.d/S99selinux
- chattr -i /usr/local/lib/libioset.so
- chattr +i /usr/local/lib/libioset.so
- chattr -i /tmp/watchdogs
- chattr +i /tmp/watchdogs
- chattr -i /etc/cron.d/tomcat
- chattr +i /etc/cron.d/tomcat
- chattr -i /etc/rc.d/init.d/watchdogs
- chattr +i /etc/rc.d/init.d/watchdogs
- chattr -i /usr/sbin/watchdogs
- chattr +i /usr/sbin/watchdogs
- chattr -i /tmp/kthrotlds
- chattr +i /tmp/kthrotlds
- chattr -i /etc/rc.d/init.d/kthrotlds
- chattr +i /etc/rc.d/init.d/kthrotlds
- chattr -i /usr/sbin/kthrotlds
- chattr +i /usr/sbin/kthrotlds
- chattr -i /etc/init.d/netdns
- chattr +i /etc/init.d/netdns
Performs operations with the file system:
Creates folders:
- /opt/nu
- /opt/yilu
- /opt/yilu/work
- /opt/yilu/work/xig
- /opt/yilu/work/xige
- /usr/bin/bsd-port
- /etc/rc.d
- /etc/rc.d/init.d
Creates or modifies files:
- /etc/cfly
- /etc/migrations
- /etc/httpdz
- /opt/nu/renice
- /opt/yilu/mservice
- /opt/yilu/work/xig/xig
- /opt/yilu/work/xige/xige
- /tmp/thisxxs
- /usr/bin/.sshd
- /usr/bin/bsd-port/getty
- /usr/bin/bsd-port/.dbus
- /usr/bin/bsd-port/nmi
- /tmp/php
- /tmp/name
- /tmp/xc.x86_64
- /usr/local/lib/libioset.so
- /tmp/watchdogs
- /usr/sbin/watchdogs
- /tmp/kthrotlds
- /usr/sbin/kthrotlds
Deletes files:
- /etc/cfly
- /etc/migrations
- /etc/httpdz
- /opt/nu/renice
- /opt/yilu/mservice
- /opt/yilu/work/xig/xig
- /opt/yilu/work/xige/xige
- /tmp/thisxxs
- /usr/bin/.sshd
- /usr/bin/bsd-port/getty
- /usr/bin/bsd-port/.dbus
- /usr/bin/bsd-port/nmi
- /tmp/php
- /tmp/name
- /tmp/xc.x86_64
- /etc/init.d/DbSecuritySpt
- /etc/init.d/selinux
- /etc/rc1.d/S97DbSecuritySpt
- /etc/rc2.d/S97DbSecuritySpt
- /etc/rc3.d/S97DbSecuritySpt
- /etc/rc4.d/S97DbSecuritySpt
- /etc/rc5.d/S97DbSecuritySpt
- /etc/rc1.d/S99selinux
- /etc/rc2.d/S99selinux
- /etc/rc3.d/S99selinux
- /etc/rc4.d/S99selinux
- /etc/rc5.d/S99selinux
- /usr/local/lib/libioset.so
- /tmp/watchdogs
- /etc/cron.d/tomcat
- /etc/rc.d/init.d/watchdogs
- /usr/sbin/watchdogs
- /tmp/kthrotlds
- /etc/rc.d/init.d/kthrotlds
- /usr/sbin/kthrotlds
- /etc/init.d/netdns
Other:
Collects information about network activity
