Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- crontab -l
- sort
- grep -v -- -bash[[:space:]]*$
- grep -- -bash[[:space:]]*$
- grep <SAMPLE_FULL_PATH>$
- uniq
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- ps aux
- crontab /root/.cron
- grep -v <SAMPLE_FULL_PATH>
- rm -rf /root/.cron
- /usr/bin/mawk awk {if($3>30.0) print $2}
- ps -A -ostat,ppid
- grep /etc/cron
- <0xd3>
- grep -v grep
- <0x151>
- wc -l
- <0x140>
- grep -v /usr/sbin/httpd
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- id -u
- ps x
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.CCwSYE
Creates or modifies files:
- /root/.cron
- /var/spool/cron/crontabs/tmp.CCwSYE
- /tmp/.lock
Deletes files:
- /root/.cron
Locks files:
- /tmp/.lock
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
DNS ASK:
- no####0.pwndns.pw
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
