Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /var/tmp/xEFmqQDcKZFQNuvRA0MEMts3R
- iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
- iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/xEFmqQDcKZFQNuvRA0MEMts3R
Creates or modifies files:
- /var/tmp/xEFmqQDcKZFQNuvRA0MEMts3R
- /dev/watchdog
Deletes files:
- /var/tmp/xEFmqQDcKZFQNuvRA0MEMts3R
Mounts file systems:
- /none
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:65527
- 127.0.0.1:65531
Establishes connection:
- 45.##.146.93:8087
Sends data to the following servers:
- 45.##.146.93:8087
Receives data from the following servers:
- 45.##.146.93:8087
