Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/DbSecuritySpt
- /etc/init.d/selinux
- /etc/rc1.d/S97DbSecuritySpt
- /etc/rc2.d/S97DbSecuritySpt
- /etc/rc3.d/S97DbSecuritySpt
- /etc/rc4.d/S97DbSecuritySpt
- /etc/rc5.d/S97DbSecuritySpt
- /etc/rc1.d/S99selinux
- /etc/rc2.d/S99selinux
- /etc/rc3.d/S99selinux
- /etc/rc4.d/S99selinux
- /etc/rc5.d/S99selinux
- /etc/cron.d/tomcat
- /etc/rc.d/init.d/watchdogs
- /etc/rc.d/init.d/kthrotlds
- /etc/init.d/netdns
- /etc/rc.d/init.d/nfstruncate
Malicious functions:
Launches processes:
- /usr/bin/getconf CLK_TCK
- chattr -i /var/tmp/.xm.log
- chattr +i /var/tmp/.xm.log
- chattr -i /tmp/systemd
- chattr +i /tmp/systemd
- chattr -i /tmp/.systemd-login
- chattr +i /tmp/.systemd-login
- chattr -i /tmp/.systemd-analyze
- chattr +i /tmp/.systemd-analyze
- chattr -i /lib/systemd/systemd-login
- chattr +i /lib/systemd/systemd-login
- chattr -i /root/.systemd-login
- chattr +i /root/.systemd-login
- chattr -i /usr/lib/libiacpkmn.so.3
- chattr +i /usr/lib/libiacpkmn.so.3
- chattr -i /etc/cfly
- chattr +i /etc/cfly
- chattr -i /etc/migrations
- chattr +i /etc/migrations
- chattr -i /etc/httpdz
- chattr +i /etc/httpdz
- chattr -i /opt/nu/renice
- chattr +i /opt/nu/renice
- chattr -i /opt/yilu/mservice
- chattr +i /opt/yilu/mservice
- chattr -i /opt/yilu/work/xig/xig
- chattr +i /opt/yilu/work/xig/xig
- chattr -i /opt/yilu/work/xige/xige
- chattr +i /opt/yilu/work/xige/xige
- chattr -i /tmp/thisxxs
- chattr +i /tmp/thisxxs
- chattr -i /usr/bin/.sshd
- chattr +i /usr/bin/.sshd
- chattr -i /usr/bin/bsd-port/getty
- chattr +i /usr/bin/bsd-port/getty
- chattr -i /usr/bin/bsd-port/.dbus
- chattr +i /usr/bin/bsd-port/.dbus
- chattr -i /usr/bin/bsd-port/nmi
- chattr +i /usr/bin/bsd-port/nmi
- chattr -i /tmp/php
- chattr +i /tmp/php
- chattr -i /tmp/name
- chattr +i /tmp/name
- chattr -i /tmp/xc.x86_64
- chattr +i /tmp/xc.x86_64
- chattr -i /etc/init.d/DbSecuritySpt
- chattr +i /etc/init.d/DbSecuritySpt
- chattr -i /etc/init.d/selinux
- chattr +i /etc/init.d/selinux
- chattr -i /etc/rc1.d/S97DbSecuritySpt
- chattr +i /etc/rc1.d/S97DbSecuritySpt
- chattr -i /etc/rc2.d/S97DbSecuritySpt
- chattr +i /etc/rc2.d/S97DbSecuritySpt
- chattr -i /etc/rc3.d/S97DbSecuritySpt
- chattr +i /etc/rc3.d/S97DbSecuritySpt
- chattr -i /etc/rc4.d/S97DbSecuritySpt
- chattr +i /etc/rc4.d/S97DbSecuritySpt
- chattr -i /etc/rc5.d/S97DbSecuritySpt
- chattr +i /etc/rc5.d/S97DbSecuritySpt
- chattr -i /etc/rc1.d/S99selinux
- chattr +i /etc/rc1.d/S99selinux
- chattr -i /etc/rc2.d/S99selinux
- chattr +i /etc/rc2.d/S99selinux
- chattr -i /etc/rc3.d/S99selinux
- chattr +i /etc/rc3.d/S99selinux
- chattr -i /etc/rc4.d/S99selinux
- chattr +i /etc/rc4.d/S99selinux
- chattr -i /etc/rc5.d/S99selinux
- chattr +i /etc/rc5.d/S99selinux
- chattr -i /usr/local/lib/libioset.so
- chattr +i /usr/local/lib/libioset.so
- chattr -i /tmp/watchdogs
- chattr +i /tmp/watchdogs
- chattr -i /etc/cron.d/tomcat
- chattr +i /etc/cron.d/tomcat
- chattr -i /etc/rc.d/init.d/watchdogs
- chattr +i /etc/rc.d/init.d/watchdogs
- chattr -i /usr/sbin/watchdogs
- chattr +i /usr/sbin/watchdogs
- chattr -i /tmp/kthrotlds
- chattr +i /tmp/kthrotlds
- chattr -i /etc/rc.d/init.d/kthrotlds
- chattr +i /etc/rc.d/init.d/kthrotlds
- chattr -i /usr/sbin/kthrotlds
- chattr +i /usr/sbin/kthrotlds
- chattr -i /etc/init.d/netdns
- chattr +i /etc/init.d/netdns
- chattr -i /etc/rc.d/init.d/nfstruncate
- chattr +i /etc/rc.d/init.d/nfstruncate
Performs operations with the file system:
Creates folders:
- /opt/nu
- /opt/yilu
- /opt/yilu/work
- /opt/yilu/work/xig
- /opt/yilu/work/xige
- /usr/bin/bsd-port
- /etc/rc.d
- /etc/rc.d/init.d
Creates or modifies files:
- /var/tmp/.xm.log
- /tmp/systemd
- /tmp/.systemd-login
- /tmp/.systemd-analyze
- /lib/systemd/systemd-login
- /root/.systemd-login
- /usr/lib/libiacpkmn.so.3
- /etc/cfly
- /etc/migrations
- /etc/httpdz
- /opt/nu/renice
- /opt/yilu/mservice
- /opt/yilu/work/xig/xig
- /opt/yilu/work/xige/xige
- /tmp/thisxxs
- /usr/bin/.sshd
- /usr/bin/bsd-port/getty
- /usr/bin/bsd-port/.dbus
- /usr/bin/bsd-port/nmi
- /tmp/php
- /tmp/name
- /tmp/xc.x86_64
- /usr/local/lib/libioset.so
- /tmp/watchdogs
- /usr/sbin/watchdogs
- /tmp/kthrotlds
- /usr/sbin/kthrotlds
Deletes files:
- /var/tmp/.xm.log
- /tmp/systemd
- /tmp/.systemd-login
- /tmp/.systemd-analyze
- /lib/systemd/systemd-login
- /root/.systemd-login
- /usr/lib/libiacpkmn.so.3
- /etc/cfly
- /etc/migrations
- /etc/httpdz
- /opt/nu/renice
- /opt/yilu/mservice
- /opt/yilu/work/xig/xig
- /opt/yilu/work/xige/xige
- /tmp/thisxxs
- /usr/bin/.sshd
- /usr/bin/bsd-port/getty
- /usr/bin/bsd-port/.dbus
- /usr/bin/bsd-port/nmi
- /tmp/php
- /tmp/name
- /tmp/xc.x86_64
- /etc/init.d/DbSecuritySpt
- /etc/init.d/selinux
- /etc/rc1.d/S97DbSecuritySpt
- /etc/rc2.d/S97DbSecuritySpt
- /etc/rc3.d/S97DbSecuritySpt
- /etc/rc4.d/S97DbSecuritySpt
- /etc/rc5.d/S97DbSecuritySpt
- /etc/rc1.d/S99selinux
- /etc/rc2.d/S99selinux
- /etc/rc3.d/S99selinux
- /etc/rc4.d/S99selinux
- /etc/rc5.d/S99selinux
- /usr/local/lib/libioset.so
- /tmp/watchdogs
- /etc/cron.d/tomcat
- /etc/rc.d/init.d/watchdogs
- /usr/sbin/watchdogs
- /tmp/kthrotlds
- /etc/rc.d/init.d/kthrotlds
- /usr/sbin/kthrotlds
- /etc/init.d/netdns
- /etc/rc.d/init.d/nfstruncate
Other:
Collects information about network activity
