Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dpkg-deb-package
- /etc/cron.d/.lib-knlib4
- /etc/cron.hourly/.lib-knlib4
- /etc/cron.daily/.lib-knlib4
- /etc/cron.weekly/.lib-knlib4
- /etc/cron.monthly/.lib-knlib4
- /var/spool/cron/crontabs/root
- /etc/cron.d/pwnrig
- /etc/cron.daily/pwnrig
- /etc/cron.hourly/pwnrig
- /etc/cron.monthly/pwnrig
- /etc/cron.weekly/pwnrig
- /etc/cron.d/sedYhS3wX
- /etc/cron.daily/sedsolnXV
- /etc/cron.hourly/sedHlOEKX
- /etc/cron.monthly/sedgmO1VZ
- /etc/cron.weekly/sedHXt8l0
Malicious functions:
Launches itself as a daemon
Manages services:
- ['systemctl', 'daemon-reload']
Launches processes:
- grep Port
- tee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
- /usr/bin/mawk awk {print \x22-\x22$2}
- ps aux
- /bin/sh /usr/bin/which update-rc.d
- head -n 1
- chattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
- mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
- hostname
- /tmp/-bash-759ef392-24ed-47e3-bfe1-6fcb949aae9d -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
- /tmp/-bash-759ef392-24ed-47e3-bfe1-6fcb949aae9d -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
- <0x2d9>
- chmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
- /usr/bin/mawk awk {print $1}
- chattr -i -a /etc/init.d/pwnrig /bin/initdr
- hostname -I
- ps x
- /usr/bin/mawk awk {if($3>30.0) print $2}
- /tmp/d4ac9d51-d15d-4701-b864-e829951982b1 kworker/R-debug
- wc -l
- cat /etc/ssh/sshd_config
- /bin/sh /usr/bin/which chkconfig
- /usr/bin/perl /usr/sbin/update-rc.d -f pwnrig disable
- cp -f -r -- /tmp/-bash-759ef392-24ed-47e3-bfe1-6fcb949aae9d /bin/bprofr
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- grep -c ^processor /proc/cpuinfo
- ps -A -ostat,ppid
- <0x9a>
- id -u
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- grep /etc/cron
- whoami
- <0x150>
- sed -i /bprofr/d ~/.bash_profile
- sed -e s/^ *//
- chattr -i -a /bin/bprofr ~/.bash_profile
- cp -f -r -- /tmp/-bash-759ef392-24ed-47e3-bfe1-6fcb949aae9d /bin/crondr
- rm -rf /bin/crondr
- grep -v grep
- rm -rf /bin/bprofr
- cut -d: -f2
- grep -v -- -bash[[:space:]]*$
- <0x1b8>
- grep -- -bash[[:space:]]*$
- <0x221>
- chattr -i -a /etc/cron.*/pwnrig /bin/crondr
- sed -i 1 s/-e // /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
- grep -m 1 model name /proc/cpuinfo
- sed -e s/$//
- grep -v /usr/sbin/httpd
- chattr +i +a /bin/bprofr ~/.bash_profile
- /usr/bin/perl /usr/sbin/update-rc.d -f pwnrig remove
Performs operations with the file system:
Modifies file access rights:
- /tmp/d4ac9d51-d15d-4701-b864-e829951982b1
- /etc/init.d/dpkg-deb-package
- /usr/bin/dpkg-debian
- /etc/cron.d/pwnrig
- /etc/cron.daily/pwnrig
- /etc/cron.hourly/pwnrig
- /etc/cron.monthly/pwnrig
- /etc/cron.weekly/pwnrig
- /usr/bin/crondr
Modifies file owner:
- /etc/cron.d/sedYhS3wX
- /etc/cron.daily/sedsolnXV
- /etc/cron.hourly/sedHlOEKX
- /etc/cron.monthly/sedgmO1VZ
- /etc/cron.weekly/sedHXt8l0
Creates or modifies files:
- /tmp/d4ac9d51-d15d-4701-b864-e829951982b1
- /tmp/5b5e67da-0d6e-4489-aedf-b1822a86ce2b
- /etc/systemd/system/dpkg-deb-package.service
- /usr/bin/dpkg-debian
- /tmp/-bash-759ef392-24ed-47e3-bfe1-6fcb949aae9d
- /tmp/.klibsystem5
- /var/spool/cron/.lib-knlib4
- /etc/anacrontab
- /tmp/.lock
- /usr/bin/bprofr
- /root/.bash_profile
- /usr/bin/crondr
Locks files:
- /tmp/.lock
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:10444
Establishes connection:
- 16#.#2.36.39:80
DNS ASK:
- ru#.##-demand.pw
Sends data to the following servers:
- 16#.#2.36.39:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
