Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c pkill -9 mips
- pkill -9 mips
- sh -c pkill -9 \"mips\"
- sh -c killall -9 mips
- sh -c killall -9 \"mips\"
- sh -c pkill -9 mipsel
- pkill -9 mipsel
- sh -c pkill -9 \"mipsel\"
- sh -c killall -9 mipsel
- sh -c killall -9 \"mipsel\"
- sh -c pkill -9 sh4
- pkill -9 sh4
- sh -c pkill -9 \"sh4\"
- sh -c killall -9 sh4
- sh -c killall -9 \"sh4\"
- sh -c pkill -9 x86
- pkill -9 x86
- sh -c pkill -9 \"x86\"
- sh -c killall -9 x86
- sh -c killall -9 \"x86\"
- sh -c pkill -9 i686
- pkill -9 i686
- sh -c pkill -9 \"i686\"
- sh -c killall -9 i686
- sh -c killall -9 \"i686\"
- sh -c pkill -9 ppc
- pkill -9 ppc
- sh -c pkill -9 \"ppc\"
- sh -c killall -9 ppc
- sh -c killall -9 \"ppc\"
- sh -c pkill -9 i586
- pkill -9 i586
- sh -c pkill -9 \"i586\"
- sh -c killall -9 i586
- sh -c killall -9 \"i586\"
- sh -c pkill -9 arm
- pkill -9 arm
- sh -c pkill -9 \"arm\"
- sh -c killall -9 arm
- sh -c killall -9 \"arm\"
- sh -c pkill -9 arm4
- pkill -9 arm4
- sh -c pkill -9 \"arm4\"
- sh -c killall -9 arm4
- sh -c killall -9 \"arm4\"
- sh -c pkill -9 arm5
- pkill -9 arm5
- sh -c pkill -9 \"arm5\"
- sh -c killall -9 arm5
- sh -c killall -9 \"arm5\"
- sh -c pkill -9 arm6
- pkill -9 arm6
- sh -c pkill -9 \"arm6\"
- sh -c killall -9 arm6
- sh -c killall -9 \"arm6\"
- sh -c pkill -9 arm7
- pkill -9 arm7
- sh -c pkill -9 \"arm7\"
- sh -c killall -9 arm7
- sh -c killall -9 \"arm7\"
- sh -c pkill -9 arc
- pkill -9 arc
- sh -c pkill -9 \"arc\"
- sh -c killall -9 arc
- sh -c killall -9 \"arc\"
- sh -c pkill -9 spc
- pkill -9 spc
- sh -c pkill -9 \"spc\"
- sh -c killall -9 spc
- sh -c killall -9 \"spc\"
- sh -c pkill -9 x86_64
- pkill -9 x86_64
- sh -c pkill -9 \"x86_64\"
- sh -c killall -9 x86_64
- sh -c killall -9 \"x86_64\"
- sh -c pkill -9 x86_32
- pkill -9 x86_32
- sh -c pkill -9 \"x86_32\"
- sh -c killall -9 x86_32
- sh -c killall -9 \"x86_32\"
- sh -c pkill -9 powerpc-440fp
- pkill -9 powerpc-440fp
- sh -c pkill -9 \"powerpc-440fp\"
- sh -c killall -9 powerpc-440fp
- sh -c killall -9 \"powerpc-440fp\"
- sh -c pkill -9 powerpc
- pkill -9 powerpc
- sh -c pkill -9 \"powerpc\"
- sh -c killall -9 powerpc
- sh -c killall -9 \"powerpc\"
- sh -c pkill -9 ntpd
- pkill -9 ntpd
- sh -c pkill -9 \"ntpd\"
- sh -c killall -9 ntpd
- sh -c killall -9 \"ntpd\"
- sh -c pkill -9 sshd
- pkill -9 sshd
- sh -c pkill -9 \"sshd\"
- sh -c killall -9 sshd
- sh -c killall -9 \"sshd\"
- sh -c pkill -9 openssh
- pkill -9 openssh
- sh -c pkill -9 \"openssh\"
- sh -c killall -9 openssh
- sh -c killall -9 \"openssh\"
- sh -c pkill -9 bash
- pkill -9 bash
- sh -c pkill -9 \"bash\"
- sh -c killall -9 bash
- sh -c killall -9 \"bash\"
- sh -c pkill -9 tftp
- pkill -9 tftp
- sh -c pkill -9 \"tftp\"
- sh -c killall -9 tftp
- sh -c killall -9 \"tftp\"
- sh -c pkill -9 wget
- pkill -9 wget
- sh -c pkill -9 \"wget\"
- sh -c killall -9 wget
- sh -c killall -9 \"wget\"
- sh -c pkill -9 cron
- pkill -9 cron
- sh -c pkill -9 \"cron\"
- sh -c killall -9 cron
- sh -c killall -9 \"cron\"
- sh -c pkill -9 ftp
- pkill -9 ftp
- sh -c pkill -9 \"ftp\"
- sh -c killall -9 ftp
- sh -c killall -9 \"ftp\"
- sh -c pkill -9 pftp
- pkill -9 pftp
- sh -c pkill -9 \"pftp\"
- sh -c killall -9 pftp
- sh -c killall -9 \"pftp\"
- sh -c pkill -9 sh
- pkill -9 sh
- sh -c pkill -9 \"sh\"
- sh -c killall -9 sh
- sh -c killall -9 \"sh\"
- sh -c pkill -9 [cpu]
- pkill -9 [cpu]
- sh -c pkill -9 \"[cpu]\"
- sh -c killall -9 [cpu]
- sh -c killall -9 \"[cpu]\"
- sh -c pkill -9 apache2
- pkill -9 apache2
- sh -c pkill -9 \"apache2\"
- sh -c killall -9 apache2
- sh -c killall -9 \"apache2\"
- sh -c pkill -9 ' '
- pkill -9
- sh -c pkill -9 \"' '\"
- pkill -9 ' '
- sh -c killall -9 ' '
- sh -c killall -9 \"' '\"
- sh -c pkill -9 nut
- pkill -9 nut
- sh -c pkill -9 \"nut\"
- sh -c killall -9 nut
- sh -c killall -9 \"nut\"
- sh -c pkill -9 sora.mips
- pkill -9 sora.mips
- sh -c pkill -9 \"sora.mips\"
- sh -c killall -9 sora.mips
- sh -c killall -9 \"sora.mips\"
- sh -c pkill -9 sora.mpsl
- pkill -9 sora.mpsl
- sh -c pkill -9 \"sora.mpsl\"
- sh -c killall -9 sora.mpsl
- sh -c killall -9 \"sora.mpsl\"
- sh -c pkill -9 sora.sh4
- pkill -9 sora.sh4
- sh -c pkill -9 \"sora.sh4\"
- sh -c killall -9 sora.sh4
- sh -c killall -9 \"sora.sh4\"
- sh -c pkill -9 sora.x86
- pkill -9 sora.x86
- sh -c pkill -9 \"sora.x86\"
- sh -c killall -9 sora.x86
- sh -c killall -9 \"sora.x86\"
- sh -c pkill -9 sora.i686
- pkill -9 sora.i686
- sh -c pkill -9 \"sora.i686\"
- sh -c killall -9 sora.i686
- sh -c killall -9 \"sora.i686\"
- sh -c pkill -9 sora.ppc
- pkill -9 sora.ppc
- sh -c pkill -9 \"sora.ppc\"
- sh -c killall -9 sora.ppc
- sh -c killall -9 \"sora.ppc\"
- sh -c pkill -9 sora.m68k
- pkill -9 sora.m68k
- sh -c pkill -9 \"sora.m68k\"
- sh -c killall -9 sora.m68k
- sh -c killall -9 \"sora.m68k\"
- sh -c pkill -9 sora.spc
- pkill -9 sora.spc
- sh -c pkill -9 \"sora.spc\"
- sh -c killall -9 sora.spc
- sh -c killall -9 \"sora.spc\"
- sh -c pkill -9 sora.arm4
- pkill -9 sora.arm4
- sh -c pkill -9 \"sora.arm4\"
- sh -c killall -9 sora.arm4
- sh -c killall -9 \"sora.arm4\"
- sh -c pkill -9 sora.arm5
- pkill -9 sora.arm5
- sh -c pkill -9 \"sora.arm5\"
- sh -c killall -9 sora.arm5
- sh -c killall -9 \"sora.arm5\"
- sh -c pkill -9 sora.arm6
- pkill -9 sora.arm6
- sh -c pkill -9 \"sora.arm6\"
- sh -c killall -9 sora.arm6
- sh -c killall -9 \"sora.arm6\"
- sh -c pkill -9 sora.arm7
- pkill -9 sora.arm7
- sh -c pkill -9 \"sora.arm7\"
- sh -c killall -9 sora.arm7
- sh -c killall -9 \"sora.arm7\"
- sh -c pkill -9 sora.arc
- pkill -9 sora.arc
- sh -c pkill -9 \"sora.arc\"
- sh -c killall -9 sora.arc
- sh -c killall -9 \"sora.arc\"
- sh -c pkill -9 Cayosin.mips
- pkill -9 Cayosin.mips
Attempts to kill system processes:
- killall -9 sshd
Kills system processes:
- sshd
Attempts to kill the following processes:
- killall -9 mips
- killall -9 mipsel
- killall -9 sh4
- killall -9 x86
- killall -9 i686
- killall -9 ppc
- killall -9 i586
- killall -9 arm
- killall -9 arm4
- killall -9 arm5
- killall -9 arm6
- killall -9 arm7
- killall -9 arc
- killall -9 spc
- killall -9 x86_64
- killall -9 x86_32
- killall -9 powerpc-440fp
- killall -9 powerpc
- killall -9 ntpd
- killall -9 openssh
- killall -9 bash
- killall -9 tftp
- killall -9 wget
- killall -9 cron
- killall -9 ftp
- killall -9 pftp
- killall -9 sh
- killall -9 [cpu]
- killall -9 apache2
- killall -9
- killall -9 ' '
- killall -9 nut
- killall -9 sora.mips
- killall -9 sora.mpsl
- killall -9 sora.sh4
- killall -9 sora.x86
- killall -9 sora.i686
- killall -9 sora.ppc
- killall -9 sora.m68k
- killall -9 sora.spc
- killall -9 sora.arm4
- killall -9 sora.arm5
- killall -9 sora.arm6
- killall -9 sora.arm7
- killall -9 sora.arc
Kills the following processes:
- systemd
- bash
- cron
- run.sh
- /bin/sh
- kworker/u2:0
- watchdog/0
- khelper
- kdevtmpfs
- khungtaskd
- writeback
- crypto
- kblockd
- rpciod
- kswapd0
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/u2:1
- kworker/u2:2
- ipv6_addrconf
- kworker/u2:3
- kworker/u2:4
- ext4-rsv-conver
- kauditd
- systemd-journal
- systemd-udevd
- khubd
- dhclient
- rpcbind
- rpc.statd
- rpc.idmapd
- dbus-daemon
Network activity:
Establishes connection:
- 8.#.8.8:53
- 10#.###.110.183:42065
Sends data to the following servers:
- 10#.###.110.183:42065
Receives data from the following servers:
- 10#.###.110.183:42065
Other:
Collects CPU information
