Technical Information
Malicious functions:
Gains root privileges
Launches processes:
- /usr/bin/chsh -s /bin/sh
- nscd -i passwd
- nscd -i group
Performs operations with the file system:
Modifies file access rights:
- /etc/passwd+
Creates symlinks:
- /etc/passwd.lock"
Creates or modifies files:
- /root/sendfile1
- /root/kmem
- /etc/.pwd.lock
- /etc/passwd.694
- /etc/passwd-
- /etc/passwd+
- /etc/passwd.699
Deletes files:
- /etc/passwd.694"
- /etc/passwd.lock"
- /etc/passwd.699"
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:31337
Establishes connection:
- 0.0.0.0:31337
Receives data from the following servers:
- 127.0.0.1:39962
