Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- lbgo
- ilfs
- xuqu
Launches processes:
- sh -c /var/tmp/hdd obky &
- /var/tmp/hdd obky
- sh -c /tmp/hdd ltje &
- /tmp/hdd ltje
- sh -c /var/tmp/hdd xgtj &
- /var/tmp/hdd xgtj
- sh -c /tmp/hdd uysm &
- /tmp/hdd uysm
- sh -c /root/skrq ilfs
- /root/skrq ilfs
- sh -c /root/xuqu xuqu
- /root/xuqu xuqu
Kills system processes:
- sshd
Kills the following processes:
- cron
- atd
- bash
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/hdd
- /tmp/hdd
- /root/skrq
- /root/xuqu
Creates or modifies files:
- /var/tmp/hdd
- /tmp/hdd
- /root/skrq
- /root/p
- /root/xuqu
Deletes files:
- /root/p
Network activity:
HTTP GET requests:
- 18#.##.68.100/jp/dld
- 18#.###.169.6/jp/jrd
- 18#.###.169.6/jp/jpp
