Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/dpkg-deb-package
Malicious functions:
Launches processes:
- /usr/bin/pgrep pkill -9 -f phpupdate
- /usr/bin/pgrep pkill -9 -f /tmp/java
- /usr/bin/pgrep pkill -9 -f watchbog
- /usr/bin/pgrep pkill -9 -f init\x5c.sh
- /usr/bin/pgrep pkill -9 -f \x5c.rsyslogds
- cat /dev/null
- bash -c ufw disable
- /usr/bin/pgrep pkill -9 -f sysDworker
- /usr/bin/pgrep pkill -9 -f 118/cf\x5c.sh
- /usr/bin/pgrep pkill -9 -f \x5c.inis
- /usr/bin/pgrep pkill -9 -f meminitsrv
- bash -c iptables -P INPUT ACCEPT
- bash -c cat /dev/null > /etc/ld.so.preload
- /tmp/662a638f-426a-4249-905c-64b07c396de0 kworker/R-debug
- /usr/bin/pgrep pkill -9 -f pnscan
- grep -Po \x5cd+
- crontab -
- /usr/sbin/xtables-nft-multi iptables -F
- /usr/bin/pgrep pkill -9 -f stratum
- /usr/bin/pgrep pkill -9 -f 8005/cc5
- bash -c chattr -ia /etc/ld.so.preload
- /usr/bin/pgrep pkill -9 -f \x5c./python
- /usr/bin/pgrep pkill -9 -f xmrig
- /usr/bin/pgrep pkill -9 -f b64decode
- bash -c iptables -P OUTPUT ACCEPT
- sed /\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d
- /usr/sbin/xtables-nft-multi iptables -P FORWARD ACCEPT
- /usr/bin/pgrep pkill -9 -f kinsing
- xargs -I % kill -9 %
- /usr/bin/pgrep pkill -9 -f attack
- cat /proc/mounts
- /usr/bin/pgrep pkill -9 -f juiceSSH
- /usr/bin/pgrep pkill -9 -f gitlabkill
- /usr/bin/pgrep pkill -9 -f phpguard
- /usr/bin/pgrep pkill -9 -f donate
- /usr/bin/pgrep pkill -9 -f sysguard
- /usr/bin/pgrep pkill -9 -f bash -s kthreaddk
- chattr -ia /etc/ld.so.preload
- /usr/bin/pgrep pkill -9 -f kthreaddi
- /usr/bin/pgrep pkill -9 -f dovecat
- /usr/bin/pgrep pkill -9 -f javae
- /usr/bin/pgrep pkill -9 -f monero
- /usr/bin/pgrep pkill -9 -f kthreaddkk
- /usr/bin/pgrep pkill -9 -f unls64\x5c.sh
- /usr/sbin/xtables-nft-multi iptables -P INPUT ACCEPT
- /usr/bin/pgrep pkill -9 -f \x5c./httpd
- /usr/bin/pgrep pkill -9 -f sysupdate
- chattr +ia /etc/init.d/dpkg-deb-package
- /usr/bin/pgrep pkill -9 -f so\x5c.txt
- ps -eo pid,ppid,comm,%cpu --sort=-%cpu
- /usr/bin/pgrep pkill -9 -f \x5c./\x5c.
- bash -c iptables -P FORWARD ACCEPT
- /usr/bin/pgrep pkill -9 -f solrd
- /usr/bin/pgrep pkill -9 -f ksoftriqd
- /usr/bin/pgrep pkill -9 -f load\x5c.sh
- bash -c iptables -F
- /usr/bin/pgrep pkill -9 -f /dev/shm
- /usr/bin/pgrep pkill -9 -f confluence/install\x5c.sh
- /usr/bin/pgrep pkill -9 -f agettyd
- bash -c crontab -l | sed \x27/\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d\x27 | crontab -
- /usr/bin/pgrep pkill -9 -f \x5c./cliented
- /usr/bin/pgrep pkill -9 -f mysqlserver
- /usr/bin/pgrep pkill -9 -f loligang
- /usr/bin/pgrep pkill -9 -f crond64
- /usr/bin/pgrep pkill -9 -f xmr-stak
- /usr/bin/pgrep pkill -9 -f bash -s 3673
- /usr/bin/pgrep pkill -9 -f \x5c./system-xfwm4-session
- /usr/bin/pgrep pkill -9 -f sshexec
- /usr/bin/pgrep pkill -9 -f solr\x5c.sh
- /usr/bin/pgrep pkill -9 -f kthreaddk
- /usr/bin/pgrep pkill -9 -f \x5c./lin64
- /usr/bin/pgrep pkill -9 -f scan\x5c.log
- /usr/bin/pgrep pkill -9 -f networkmanager
- /usr/sbin/xtables-nft-multi iptables -P OUTPUT ACCEPT
- /usr/bin/pgrep pkill -9 -f \x5c./crun
- /usr/bin/pgrep pkill -9 -f excludefile
- /usr/bin/pgrep pkill -9 -f sshpass
- /usr/bin/pgrep pkill -9 -f pastebin
- /usr/bin/pgrep pkill -9 -f knthread
- grep -P /proc/\x5cd+
- /usr/bin/pgrep pkill -9 -f /tmp/\x5c.
- /usr/bin/pgrep pkill -9 -f networkservice
- /usr/bin/pgrep pkill -9 -f zgrab
- /usr/bin/pgrep pkill -9 -f masscan
- crontab -l
- /usr/bin/pgrep pkill -9 -f MCf8
- /usr/bin/pgrep pkill -9 -f /tmp/system
- /usr/bin/pgrep pkill -9 -f /var/tmp
- /usr/bin/pgrep pkill -9 -f \x5c.6379
- /usr/bin/pgrep pkill -9 -f polska
- /usr/bin/pgrep pkill -9 -f kdevtmpfsi
- /usr/bin/pgrep pkill -9 -f kthreaddw
- /usr/bin/pgrep pkill -9 -f mysqldd
- /usr/bin/mawk awk {print $2}
- /usr/bin/pgrep pkill -9 -f certutil
- /usr/bin/pgrep pkill -9 -f cnrig
- bash -c cat /proc/mounts | awk \x27{print $2}\x27 | grep -P \x27/proc/\x5cd+\x27 | grep -Po \x27\x5cd+\x27 | xargs -I % kill -9 %
- bash -c pgrep -f \x27meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh\x27 | xargs -r kill
Kills the following processes:
- ps
- bash
Performs operations with the file system:
Modifies file access rights:
- /tmp/662a638f-426a-4249-905c-64b07c396de0
- /etc/init.d/dpkg-deb-package
Creates or modifies files:
- /tmp/662a638f-426a-4249-905c-64b07c396de0
- /tmp/7877e997-d4cd-47a5-a6df-4cb00e5599d9
- /var/spool/cron/crontabs/tmp.ZOhTBA
- /etc/ld.so.preload
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:10444
Establishes connection:
- 127.0.0.1:10444
Other:
Collects OS information
Collects CPU information
Collects RAM information
