Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.d/root
- /var/spool/cron/crontabs/root
- /etc/init.d/sshservice
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K01sshservice
- /etc/rc1.d/K01sshservice
- /etc/rc2.d/S01sshservice
- /etc/rc3.d/S01sshservice
- /etc/rc4.d/S01sshservice
- /etc/rc5.d/S01sshservice
- /etc/rc6.d/K01sshservice
Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
- gcc /usr/local/lib/libevent_extrad.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libevent_extrad.so
Manages services:
- systemctl enable sshservice.service
- /usr/sbin/update-rc.d sshservice defaults
- systemctl daemon-reload
- /usr/sbin/update-rc.d sshservice enable
- systemctl reload sshservice.service
Launches processes:
- <SAMPLE_FULL_PATH> [kworker]
- <SAMPLE_FULL_PATH> [kmpath_rdacd]
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;chkconfig --add sshservice
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;systemctl enable sshservice.service;systemctl reload sshservice.service
- /sbin/insserv sshservice
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;gcc /usr/local/lib/libevent_extrad.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libevent_extrad.so
Performs operations with the file system:
Modifies file access rights:
- /etc/hosts
- /etc/cron.d/root
- /var/spool/cron/root
- /var/spool/cron/crontabs/root
- /usr/local/lib/libevent_extrad.c
- /usr/local/lib/libevent_extrad.so
- /etc/ld.so.preload
Creates symlinks:
- /etc/systemd/system/multi-user.target.wants/sshservice.service
Creates or modifies files:
- /usr/local/sbin/<SAMPLE>
- /etc/hosts
- /var/spool/cron/root
- /usr/lib/systemd/system/sshservice.service
- /lib/systemd/system/sshservice.service
- /etc/systemd/system/sshservice.service
- /usr/local/lib/libevent_extrad.c
- /tmp/cccxogc6.s
- /tmp/ccty2LiZ.o
- /tmp/ccicUhcT.res
- /tmp/cckqcwEH.c
- /tmp/ccZmVKKB.o
- /tmp/ccXTfhRv.ld
- /tmp/cc0OSWXp.le
- /usr/local/lib/libevent_extrad.so
- /etc/ld.so.preload
- /usr/local/sbin/aa_sffs
Deletes files:
- /etc/ld.so.preload
- /usr/local/lib/libevent_extrad.so
- /usr/local/lib/libevent_extrad.c
- /tmp/ccXTfhRv.ld
- /tmp/cc0OSWXp.le
- /tmp/cckqcwEH.c
- /tmp/ccZmVKKB.o
- /tmp/ccicUhcT.res
- /tmp/ccty2LiZ.o
- /tmp/cccxogc6.s
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:61961
Establishes connection:
- <LOCAL_DNS_SERVER>
- 127.0.0.1:61961
DNS ASK:
- cr##.#######bety6vifaxsi9vovnc9jjay2l.com
Other:
Collects RAM information
