Technical Information
Malicious functions:
Substitutes application name for:
- <SAMPLE>
Launches processes:
Performs operations with the file system:
Modifies file access rights:
- /tmp/_MEIPqSZaD/_cffi_backend.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/bcrypt/_bcrypt.abi3.so
- /tmp/_MEIPqSZaD/cryptography/hazmat/bindings/_openssl.abi3.so
- /tmp/_MEIPqSZaD/cryptography/hazmat/bindings/_padding.abi3.so
- /tmp/_MEIPqSZaD/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/libbz2.so.1.0
- /tmp/_MEIPqSZaD/libcrypto.so.1.1
- /tmp/_MEIPqSZaD/libexpat.so.1
- /tmp/_MEIPqSZaD/libffi.so.7
- /tmp/_MEIPqSZaD/liblzma.so.5
- /tmp/_MEIPqSZaD/libmpdec.so.3
- /tmp/_MEIPqSZaD/libpython3.9.so.1.0
- /tmp/_MEIPqSZaD/libreadline.so.8
- /tmp/_MEIPqSZaD/libssl.so.1.1
- /tmp/_MEIPqSZaD/libtinfo.so.6
- /tmp/_MEIPqSZaD/libz.so.1
- /tmp/_MEIPqSZaD/base_library.zip
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/PKG-INFO
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/dependency_links.txt
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/not-zip-safe
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/requires.txt
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/top_level.txt
Creates folders:
- /tmp/_MEIPqSZaD
- /tmp/_MEIPqSZaD/bcrypt
- /tmp/_MEIPqSZaD/cryptography
- /tmp/_MEIPqSZaD/cryptography/hazmat
- /tmp/_MEIPqSZaD/cryptography/hazmat/bindings
- /tmp/_MEIPqSZaD/lib-dynload
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info
Creates or modifies files:
- /tmp/_MEIPqSZaD/_cffi_backend.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/bcrypt/_bcrypt.abi3.so
- /tmp/_MEIPqSZaD/cryptography/hazmat/bindings/_openssl.abi3.so
- /tmp/_MEIPqSZaD/cryptography/hazmat/bindings/_padding.abi3.so
- /tmp/_MEIPqSZaD/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
- /tmp/_MEIPqSZaD/libbz2.so.1.0
- /tmp/_MEIPqSZaD/libcrypto.so.1.1
- /tmp/_MEIPqSZaD/libexpat.so.1
- /tmp/_MEIPqSZaD/libffi.so.7
- /tmp/_MEIPqSZaD/liblzma.so.5
- /tmp/_MEIPqSZaD/libmpdec.so.3
- /tmp/_MEIPqSZaD/libpython3.9.so.1.0
- /tmp/_MEIPqSZaD/libreadline.so.8
- /tmp/_MEIPqSZaD/libssl.so.1.1
- /tmp/_MEIPqSZaD/libtinfo.so.6
- /tmp/_MEIPqSZaD/libz.so.1
- /tmp/_MEIPqSZaD/base_library.zip
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/PKG-INFO
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/dependency_links.txt
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/not-zip-safe
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/requires.txt
- /tmp/_MEIPqSZaD/cryptography-3.3.2.egg-info/top_level.txt
- /root/fernsomeware.key
- <SAMPLE_FULL_PATH>
- /root/run.sh
- /root/stdout.log
- /root/stub.sh
- /root/.profile
- /root/.bash_history
- /root/.viminfo
- /root/.bashrc
