Technical Information
Malicious functions:
Removes itself
Modifies firewall settings:
- iptables -D INPUT -p tcp --dport 45848 -j ACCEPT
- iptables -I INPUT -p tcp --dport 45848 -j ACCEPT
- iptables -D INPUT -p tcp --dport 45921 -j ACCEPT
- iptables -I INPUT -p tcp --dport 45921 -j ACCEPT
Launches processes:
- /bin/sh -c rm <SAMPLE_FULL_PATH>
- rm <SAMPLE_FULL_PATH>
- /bin/sh -c iptables -D INPUT -p tcp --dport 45848 -j ACCEPT
- /bin/sh -c iptables -I INPUT -p tcp --dport 45848 -j ACCEPT
- /bin/sh -c iptables -D INPUT -p tcp --dport 45921 -j ACCEPT
- /bin/sh -c iptables -I INPUT -p tcp --dport 45921 -j ACCEPT
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:45848
- 0.0.0.0:45921
