Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches processes:
- /usr/bin/pgrep pkill -9 -f kthreaddkk
- /usr/bin/pgrep pkill -9 -f crond64
- /usr/bin/pgrep pkill -9 -f certutil
- /usr/bin/pgrep pkill -9 -f agettyd
- grep -Po \x5cd+
- /usr/bin/pgrep pkill -9 -f sshexec
- /usr/sbin/xtables-nft-multi iptables -P INPUT ACCEPT
- /usr/bin/pgrep pkill -9 -f mysqldd
- /usr/bin/pgrep pkill -9 -f pnscan
- /usr/bin/pgrep pkill -9 -f kinsing
- /usr/bin/pgrep pkill -9 -f monero
- bash -c pgrep -f \x27meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh\x27 | xargs -r kill
- /usr/bin/pgrep pkill -9 -f kdevtmpfsi
- /usr/bin/pgrep pkill -9 -f sysDworker
- /usr/bin/pgrep pkill -9 -f \x5c./python
- /usr/bin/pgrep pkill -9 -f donate
- cat /dev/null
- crontab -l
- /usr/bin/pgrep pkill -9 -f xmrig
- /usr/bin/pgrep pkill -9 -f kthreaddw
- /usr/bin/pgrep pkill -9 -f dovecat
- /usr/bin/pgrep pkill -9 -f /tmp/\x5c.
- /usr/bin/pgrep pkill -9 -f bash -s 3673
- /usr/bin/pgrep pkill -9 -f bash -s kthreaddk
- /usr/bin/pgrep pkill -9 -f solr\x5c.sh
- /usr/bin/pgrep pkill -9 -f sysguard
- /usr/bin/pgrep pkill -9 -f \x5c./system-xfwm4-session
- bash -c ufw disable
- bash -c cat /proc/mounts | awk \x27{print $2}\x27 | grep -P \x27/proc/\x5cd+\x27 | grep -Po \x27\x5cd+\x27 | xargs -I % kill -9 %
- /usr/bin/pgrep pkill -9 -f unls64\x5c.sh
- /usr/bin/pgrep pkill -9 -f confluence/install\x5c.sh
- bash -c crontab -l | sed \x27/\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d\x27 | crontab -
- /usr/bin/pgrep pkill -9 -f MCf8
- /usr/sbin/xtables-nft-multi iptables -P FORWARD ACCEPT
- /usr/bin/pgrep pkill -9 -f so\x5c.txt
- /usr/bin/pgrep pkill -9 -f \x5c./cliented
- /usr/bin/pgrep pkill -9 -f /tmp/system
- /usr/bin/pgrep pkill -9 -f stratum
- /usr/bin/pgrep pkill -9 -f /dev/shm
- /usr/sbin/xtables-nft-multi iptables -F
- /usr/bin/pgrep pkill -9 -f loligang
- /usr/bin/pgrep pkill -9 -f kthreaddi
- /usr/bin/pgrep pkill -9 -f 8005/cc5
- /usr/bin/pgrep pkill -9 -f \x5c./\x5c.
- bash -c chattr -ia /etc/ld.so.preload
- bash -c cat /dev/null > /etc/ld.so.preload
- sed /\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d
- /usr/bin/pgrep pkill -9 -f sshpass
- /usr/bin/pgrep pkill -9 -f \x5c./httpd
- xargs -r kill
- crontab -
- /usr/bin/pgrep pkill -9 -f \x5c.6379
- ps -eo pid,ppid,comm,%cpu --sort=-%cpu
- /usr/bin/pgrep pkill -9 -f javae
- /usr/bin/pgrep pkill -9 -f \x5c./lin64
- /usr/bin/pgrep pkill -9 -f load\x5c.sh
- /tmp/c9ea37fb-e9f0-4d33-8593-8cdbf3cf02d5 kworker/R-debug
- grep -P /proc/\x5cd+
- /usr/bin/pgrep pkill -9 -f \x5c./crun
- /usr/bin/pgrep pkill -9 -f attack
- /usr/bin/pgrep pkill -9 -f juiceSSH
- bash -c iptables -F
- pgrep -f meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh
- /usr/bin/pgrep pkill -9 -f cnrig
- cat /proc/mounts
- /usr/bin/pgrep pkill -9 -f masscan
- /usr/bin/mawk awk {print $2}
- /usr/bin/pgrep pkill -9 -f /var/tmp
- /usr/bin/pgrep pkill -9 -f /tmp/java
- bash -c iptables -P FORWARD ACCEPT
- /usr/bin/pgrep pkill -9 -f 118/cf\x5c.sh
- /usr/bin/pgrep pkill -9 -f \x5c.rsyslogds
- bash -c iptables -P OUTPUT ACCEPT
- chattr -ia /etc/ld.so.preload
- /usr/bin/pgrep pkill -9 -f init\x5c.sh
- /usr/bin/pgrep pkill -9 -f pastebin
- /usr/sbin/xtables-nft-multi iptables -P OUTPUT ACCEPT
- /usr/bin/pgrep pkill -9 -f xmr-stak
- bash -c iptables -P INPUT ACCEPT
- /usr/bin/pgrep pkill -9 -f b64decode
- /usr/bin/pgrep pkill -9 -f \x5c.inis
- xargs -I % kill -9 %
- /usr/bin/pgrep pkill -9 -f excludefile
Kills the following processes:
- ps
- mandb
Performs operations with the file system:
Modifies file access rights:
- /tmp/c9ea37fb-e9f0-4d33-8593-8cdbf3cf02d5
- /var/spool/cron/crontabs/tmp.DjjuaY
Creates or modifies files:
- /tmp/c9ea37fb-e9f0-4d33-8593-8cdbf3cf02d5
- /tmp/645a447a-030c-4fd1-88f2-f723d19b92fc
- /etc/ld.so.preload
- /var/spool/cron/crontabs/tmp.DjjuaY
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- 127.0.0.1:10444
Other:
Collects OS information
Collects CPU information
Collects RAM information
