Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dpkg-deb-package
- /var/spool/cron/crontabs/root
- /etc/cron.d/.lib-knlib4
- /etc/cron.hourly/.lib-knlib4
Creates or modifies the following symlinks:
- /etc/rc2.d/S01dpkg-deb-package
- /etc/rc3.d/S01dpkg-deb-package
- /etc/rc4.d/S01dpkg-deb-package
- /etc/rc5.d/S01dpkg-deb-package
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- (sysv-install)
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'dpkg-deb-package.service']
Launches processes:
- /usr/bin/perl /usr/sbin/update-rc.d dpkg-deb-package defaults
- <0x261>
- grep Port
- chattr +ia /etc/systemd/system/dpkg-deb-package.service
- cp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package
- /bin/sh /lib/systemd/systemd-sysv-install enable dpkg-deb-package
- bash -c ufw disable
- hostname -I
- sed -e s/^ *//
- ps aux
- chattr +ia /var/spool/cron/.lib-knlib4
- <0x16f>
- grep /etc/cron
- cat /etc/ssh/sshd_config
- /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
- getopt -o r: --long root: -- enable dpkg-deb-package
- cut -d: -f2
- grep -c ^processor /proc/cpuinfo
- /usr/bin/pgrep pkill -f .klibsystem4
- grep -v grep
- rm -rf -- dpkg-deb-package
- /tmp/-bash-1f1b229f-7d96-425a-b04c-4a88c8eb03a2 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
- ps x
- grep -v /usr/sbin/httpd
- crontab -r
- ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
- <0x1e6>
- chattr +ia /root/.bash_profile
- head -n 1
- wc -l
- nohup ./dpkg-deb-package
- whoami
- ps -A -ostat,ppid
- chattr +ia /etc/cron.hourly/.lib-knlib4
- /usr/bin/mawk awk {if($3>30.0) print $2}
- /usr/bin/mawk awk {print $1}
- /tmp/-bash-1f1b229f-7d96-425a-b04c-4a88c8eb03a2 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
- grep -v -- -bash[[:space:]]*$
- grep -- -bash[[:space:]]*$
- grep -m 1 model name /proc/cpuinfo
- chattr +ia /etc/init.d/dpkg-deb-package
- crontab -
- bash -c echo \x22* * * * * nohup /var/tmp/.klibsystem5 >/dev/null 2>&1 &\x22 | crontab -
- <0x94>
- /bin/bash /etc/init.d/dpkg-deb-package start
- chattr +ia /bin/dpkg-debian
- /usr/bin/mawk awk {print \x22-\x22$2}
- chattr +ia /etc/cron.d/.lib-knlib4
- hostname
- id -u
- /usr/bin/perl /usr/sbin/update-rc.d dpkg-deb-package enable
- sed -e s/$//
Kills the following processes:
- systemctl
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/dpkg-deb-package
- /usr/bin/dpkg-debian
- /var/spool/cron/crontabs/tmp.IAUOid
Creates or modifies files:
- /tmp/-bash-1f1b229f-7d96-425a-b04c-4a88c8eb03a2
- /etc/systemd/system/dpkg-deb-package.service
- /tmp/.lock
- /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
- /root/.bash_profile
- /usr/bin/dpkg-debian
- /var/tmp/.klibsystem5
- /var/spool/cron/crontabs/tmp.IAUOid
- /var/spool/cron/.lib-knlib4
Locks files:
- /tmp/.lock
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:10444
Establishes connection:
- 0.0.0.0:10444
- 0.0.0.0:59475
- 0.0.0.0:444
- 85.###.56.107:80
DNS ASK:
- ru#.##-demand.pw
Sends data to the following servers:
- 85.###.56.107:80
Receives data from the following servers:
- 85.###.56.107:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
