Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/knlib
Malicious functions:
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'knlibe.service']
Launches processes:
- cp -f -r -- /bin/knlib /bin/klibsystem4
- rm -rf /etc/sysctl.conf
- sysctl -p
- bash -c rm -rf /etc/sysctl.conf ; echo fs.file-max = 2097152 > /etc/sysctl.conf ; sysctl -p ; ulimit -Hn ; ulimit -n 99999 -u 999999
- chattr +ia /etc/systemd/system/knlibe.service
- /bin/bash /etc/init.d/knlib start
- nohup ./klibsystem4
- chattr +ia /etc/init.d/knlib
- rm -rf -- klibsystem4
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/knlib
Creates or modifies files:
- /etc/sysctl.conf
- /proc/sys/fs/file-max
- /tmp/.klibsystem4.lock
- /etc/systemd/system/knlibe.service
Deletes files:
- /etc/sysctl.conf
Locks files:
- /tmp/.klibsystem4.lock
