Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
- /etc/profile.d/bash_config
- /etc/profile.d/linux.sh
- /etc/profile.d/bash_config.sh
- /etc/init.d/ssh
- /etc/init.d/linux_kill
- /etc/crontab
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/linux_kill
- /etc/rc1.d/linux_kill
- /etc/rc2.d/linux_kill
- /etc/rc3.d/linux_kill
- /etc/rc4.d/linux_kill
- /etc/rc5.d/linux_kill
- /etc/rc6.d/linux_kill
- /etc/rc2.d/S01linux_kill
- /etc/rc3.d/S01linux_kill
- /etc/rc4.d/S01linux_kill
- /etc/rc5.d/S01linux_kill
Malicious functions:
Replaces the following system files:
- /bin/ps
- /bin/ss
- /bin/netstat
- /usr/bin/lsof
Manages services:
- update-rc.d linux_kill defaults
- systemctl daemon-reload
Launches processes:
- <SAMPLE_FULL_PATH>
- top -b -n 1 -d 1
- /bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
- /bin/bash -c
- /bin/bash -c echo -e \"#!/bin/sh\nwhile [ 1 ]; do\nsleep 30\n/etc/id.services.conf\ndone\n\" > /etc/32679
- /bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
- /bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so\" > /.img
- /bin/bash -c chmod 0755 /etc/32679
- chmod +x /etc/init.d/linux_kill
- /bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- chmod 0755 /etc/32679
- /bin/bash -c chmod 0755 /.img
- /etc/32679
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
- sleep 30
- chmod 0755 /.img
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
- /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
- /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
- /bin/bash -c update-rc.d linux_kill defaults;chkconfig --add linux_kill
- /sbin/insserv linux_kill
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/linux_kill
- /etc/32679
- /.img
Creates folders:
- /usr/bin/lib
Creates symlinks:
- /etc/rcS.d/linux_kill
Creates or modifies files:
- /dev/.img
- /usr/lib/libdlrpcld.so
- /etc/id.services.conf
- /lib/system-monitor
- /boot/System.img.config
- /bin/ps
- /usr/sbin/ifconfig.conf
- /bin/ss
- /etc/32679
- /.img
- /bin/ls
- /bin/dir
- /bin/netstat
- /usr/bin/find
- /usr/bin/lsof
Locks files:
- /dev/.img
Network activity:
Establishes connection:
- 8.#.8.8:53
- 0.0.0.0:41414
- 0.0.0.0:32679
DNS ASK:
- 1.####ionday.xyz
- ww#.#s11.com
- ww#.#x66.com
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
