Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- sh -c (crontab -l| grep -vw c2a5ad64fe; echo \"*/10 * * * * /root/c2a5ad64fe >/dev/null 2>&1\") | crontab -
- crontab -l
- crontab -
- grep -vw c2a5ad64fe
- /root/c2a5ad64fe
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.GJiT7X
- /root/c2a5ad64fe
- /var/spool/cron/crontabs/tmp.tfLjqA
- /var/spool/cron/crontabs/tmp.WO8kng
Creates folders:
- /root/.td
- /root/.td/keys
Creates or modifies files:
- /root/c2a5ad64fe
- /var/spool/cron/crontabs/tmp.GJiT7X
- /var/spool/cron/crontabs/tmp.tfLjqA
- /root/.td/lock
- /root/.td/state.tmp
- /var/spool/cron/crontabs/tmp.WO8kng
Deletes files:
- /root/c2a5ad64fe
- /root/.td/key-pinning-entries
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:65533
Establishes connection:
- 18#.###.101.30:20030
- 66.###.2.16:9001
- 21#.##9.62.232:443
- 10#.##.10.175:80
DNS ASK:
- ip##.#canhazip.com
Other:
Collects RAM information
