Technical Information
Malicious functions:
Removes itself
Launches processes:
- /bin/.securetty/.esd-644/auditd
- /bin/sh
- /bin/sh -c nohup /bin/.securetty/.esd-644/devkit-power-daemon > /dev/null 2>&1 &
- nohup /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/devkit-power-daemon
- bash -c uname -r;cat /etc/issue
- /bin/sh -c kill -9
- uname -r
- cat /etc/issue
- /bin/sh -c kill -9 714
Kills the following processes:
- /bin/.securetty/.esd-644/devkit-power-daemon
Performs operations with the file system:
Modifies file access rights:
- /bin/.securetty/.esd-644
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/devkit-power-daemon
Creates folders:
- /bin/.securetty
- /bin/.securetty/.esd-644
Creates or modifies files:
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/.nginx.lockfile
- /bin/.securetty/.esd-644/devkit-power-daemon
- /bin/.securetty/.esd-644/.httpd.lockfile
- /bin/.securetty/.esd-644/.1e8247d9f7f3f4fe8f1c097094d7ff08
Deletes files:
- /bin/.securetty/.esd-644/auditd
- /bin/.securetty/.esd-644/devkit-power-daemon
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 18#.##4.218.247:53
HTTP GET requests:
- bo#.#####g.com:80/l/sodd/ver
- bo#.######.#om:80/l/sodd/Security.Script
DNS ASK:
- bo#.#onf1g.com
- lo#.#onf1g.com
Other:
Collects OS information
Collects RAM information
