Technical Information
Malicious functions:
Manages services:
- ['systemctl', 'list-unit-files']
- ['systemctl', 'status', 'trojan']
Launches processes:
- head -n 1
- grep tag_name
- id -u
- uname -m
- curl -LO --progress-bar https://github.com/trojan-gfw/trojan/releases/download/v1.16.0/trojan-1.16.0-linux-amd64.tar.xz
- cut -d\x22 -f4
- sed s/v//g
- grep trojan.service
- mktemp -d
- tar xf trojan-1.16.0-linux-amd64.tar.xz
- mkdir -p /usr/bin/trojan /usr/local/etc/trojan
- curl -H Cache-Control: no-cache -s https://api.github.com/repos/trojan-gfw/trojan/releases/latest
- bash -c systemctl list-unit-files|grep trojan.service
- bash -c systemctl status trojan
- <0xbb>
- xz -d
Performs operations with the file system:
Modifies file access rights:
- /tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples
- /tmp/tmp.DfiiJhMHoc/trojan/config.json
Modifies file owner:
- /tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples
- /tmp/tmp.DfiiJhMHoc/trojan/config.json
Creates folders:
- /var/lib/trojan-manager
- /tmp/tmp.DfiiJhMHoc
- /usr/bin/trojan
- /usr/local/etc/trojan
- /tmp/tmp.DfiiJhMHoc/trojan
- /tmp/tmp.DfiiJhMHoc/trojan/examples
Creates or modifies files:
- /var/lib/trojan-manager/LOCK
- /var/lib/trojan-manager/LOG
- /var/lib/trojan-manager/MANIFEST-000000
- /var/lib/trojan-manager/CURRENT.0
- /var/lib/trojan-manager/000001.log
- /var/lib/trojan-manager/000002.log
- /var/lib/trojan-manager/MANIFEST-000003
- /var/lib/trojan-manager/CURRENT.bak
- /var/lib/trojan-manager/CURRENT.3
- /tmp/tmp.DfiiJhMHoc/trojan-1.16.0-linux-amd64.tar.xz
- /tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/config.json
- /tmp/tmp.DfiiJhMHoc/trojan/trojan
Deletes files:
- /var/lib/trojan-manager/MANIFEST-000000
- /var/lib/trojan-manager/000001.log
Locks files:
- /var/lib/trojan-manager/LOCK
Changes time of creation/access/modification of files:
- /tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
- /tmp/tmp.DfiiJhMHoc/trojan/examples
- /tmp/tmp.DfiiJhMHoc/trojan/config.json
Network activity:
Establishes connection:
- 8.#.8.8:53
- 14#.##.121.5:443
- 14#.##.121.3:443
- 18#.##9.111.133:443
- (e##val)
- 18#.##9.110.133:443
- 18#.##9.108.133:443
- 18#.##9.109.133:443
DNS ASK:
- ap#.#ithub.com
- gi##ub.com
- ob#####.#ithubusercontent.com
Sends data to the following servers:
- 14#.##.121.5:443
- 14#.##.121.3:443
- 18#.##9.111.133:443
Receives data from the following servers:
- 14#.##.121.5:443
- 14#.##.121.3:443
- 18#.##9.111.133:443
Other:
Collects information about network activity
