Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
- /usr/bin/crontab -
- /usr/bin/crontab
- bash -c echo \x22* * * * * <SAMPLE_FULL_PATH>\x22 | /usr/bin/crontab -
- <SAMPLE_FULL_PATH> {70d0be7374677265733a207265706c69636174696f6e206c61756e63686572}
- mount
- ./cpu_hu
- bash -c /usr/bin/crontab -r
- bash -c ./cpu_hu
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.d4GSrt
- /var/spool/cron/crontabs/tmp.SZSh8O
Creates or modifies files:
- /tmp/.private-fAUZbhy7B45fgmk1Gqci-login.service-S90agO
- /tmp/.private-YO1lKF399NbEEUQUNDMl-login.service-CgeHDZ
- /tmp/.sh_history
- /var/spool/cron/crontabs/tmp.d4GSrt
- /var/spool/cron/crontabs/tmp.SZSh8O
- /usr/lib/tasksel/packages/cpu_hu
Locks files:
- /tmp/.private-fAUZbhy7B45fgmk1Gqci-login.service-S90agO
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
Sends data to the following servers:
- <LOCAL_DNS_SERVER>
Receives data from the following servers:
- <LOCAL_DNS_SERVER>
Other:
Collects CPU information
Collects information about network activity
