Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- /usr/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uchlka
- /usr/local/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uchlka
- /sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uchlka
- /usr/sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uchlka
- /bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/uchlka
- /usr/bin/chattr -i /etc/ld.so.preload
- /usr/bin/chattr -i /etc/cron.d/root
- /usr/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yuijuu
- /usr/local/bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yuijuu
- /sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yuijuu
- /usr/sbin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yuijuu
- /bin/cp -f <SAMPLE_FULL_PATH> /usr/bin/yuijuu
Kills system processes:
- sshd
Kills the following processes:
- <SAMPLE>
- systemd
- kthreadd
- ksoftirqd/0
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- rcu_sched
- rcu_bh
- migration/0
- watchdog/0
- khelper
- kdevtmpfs
- netns
- khungtaskd
- writeback
- ksmd
- crypto
- kintegrityd
- bioset
- kblockd
- kworker/0:1
- kswapd0
- fsnotify_mark
- kthrotld
- ipv6_addrconf
- deferwq
- kworker/u2:1
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/u2:2
- kworker/u2:3
- kworker/0:2
- kworker/0:1H
- jbd2/sda1-8
- ext4-rsv-conver
- kworker/0:3
- kauditd
- systemd-journal
- systemd-udevd
- kpsmoused
- ttm_swap
- kvm-irqfd-clean
- dhclient
- rpcbind
- rpc.statd
- rpciod
- nfsiod
- rpc.idmapd
- cron
- atd
- systemd-logind
- rsyslogd
- acpid
- dbus-daemon
- agetty
- exim4
- (sd-pam)
- bash
- run.sh
Performs operations with the file system:
Creates folders:
- /var/lib/.eonm
- /root/.ssh
Creates or modifies files:
- /var/lib/.eonm/.local
- /usr/bin/uchlka
- /usr/bin/yuijuu
Locks files:
- /var/lib/.eonm/.local
Network activity:
Establishes connection:
- 58.###.204.171:48029
- 22#.#.5.5:53
- 20#.##.222.222:443
- 1.#.1.1:53
- 8.#.8.8:53
- 11#.#9.29.29:53
- 10#.##.201.118:46114
- 21#.#39.38.21:9
- [2#######0:c000:1000::501]:9
- 66.###.248.178:9
- 21#.#39.32.21:9
- 21#.#39.36.21:9
- 2.##.194.153:9
- 2.##.194.136:9
- 34.###.181.158:9
- 21#.#39.34.21:9
- 12#.##.145.255:40621
- 10#.#0.16.242:9
- 10#.#0.17.242:9
- 18.###.132.216:9
- 2.##.242.202:9
- 2.##.242.243:9
- 34.##7.12.81:9
- 34.###.132.204:9
- 23.##.7.114:9
- 23.##.7.80:9
- 18.##3.90.151:9
- 18.###.112.207:9
- 3.###.145.145:9
- 52.##6.178.1:9
- 12#.##.18.216:37733
- 11#.##.9.63:35459
- 34.###.250.175:9
- 52.###.161.135:9
- 34.##6.80.17:9
- 52.#.197.231:9
- 11#.##.201.176:32770
- 58.###.204.171:56783
- 10#.###.106.71:35280
HTTP GET requests:
- ip##.#canhazip.com/
- bo#.####ismyipaddress.com/
- ip###o.io/ip
- wh#####yip.akamai.com/
- v4.##ent.me/
- ip####.net/plain
- ch#####.amazonaws.com/
- lm#.##wvg.com/jobs
DNS ASK:
- ip##ho.net
- ip##.#canhazip.com
- v4.#dent.me
- ch#####.amazonaws.com
- bo#.####ismyipaddress.com
- wh#####yip.akamai.com
- ip##fo.io
Sends data to the following servers:
- 58.###.204.171:48029
- 20#.##.222.222:443
- 1.#.1.1:53
- 10#.##.201.118:46114
- 12#.##.18.216:37733
- 11#.##.9.63:35459
- 11#.##.201.176:32770
Receives data from the following servers:
- 20#.##.222.222:443
- 1.#.1.1:53
- 58.###.204.171:48029
- 10#.##.201.118:46114
- 12#.##.18.216:37733
- 11#.##.9.63:35459
- 11#.##.201.176:32770
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
