Technical Information
Malicious functions:
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- cat /dev/urandom
- tr -cd a-f0-9
- head -c 32
- mkdir -p /var/tmp/. /
- touch /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
- chmod +x /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
- rm -rf /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
- ps x
- grep -v 707
- awk {print $1}
- grep -a gmail.com\|lkrbugs\|4010010001.xyz\|ail.com
- grep -va grep
- cat /proc/1/cmdline
- tr -d
- tr -d \n
- grep -va startcmd
- grep -va com-px-t$t\"startcmd=\".
- grep -va xmr-t$t\"startcmd=\"
- cat /proc/2/cmdline
- cat /proc/3/cmdline
- cat /proc/4/cmdline
- cat /proc/5/cmdline
- cat /proc/6/cmdline
- cat /proc/7/cmdline
- cat /proc/8/cmdline
- cat /proc/9/cmdline
- cat /proc/10/cmdline
- cat /proc/11/cmdline
- cat /proc/12/cmdline
- cat /proc/13/cmdline
- cat /proc/14/cmdline
- cat /proc/15/cmdline
- cat /proc/16/cmdline
- cat /proc/17/cmdline
- cat /proc/18/cmdline
- cat /proc/19/cmdline
- cat /proc/20/cmdline
- cat /proc/21/cmdline
- cat /proc/22/cmdline
- cat /proc/23/cmdline
- cat /proc/29/cmdline
- cat /proc/30/cmdline
- cat /proc/31/cmdline
- cat /proc/32/cmdline
- cat /proc/66/cmdline
- cat /proc/67/cmdline
- cat /proc/68/cmdline
- cat /proc/69/cmdline
- cat /proc/70/cmdline
- cat /proc/71/cmdline
- cat /proc/73/cmdline
- cat /proc/76/cmdline
- cat /proc/97/cmdline
- cat /proc/98/cmdline
- cat /proc/129/cmdline
- cat /proc/135/cmdline
- cat /proc/142/cmdline
- cat /proc/161/cmdline
- cat /proc/170/cmdline
- cat /proc/171/cmdline
- cat /proc/174/cmdline
- cat /proc/352/cmdline
- cat /proc/375/cmdline
- cat /proc/389/cmdline
- cat /proc/392/cmdline
- cat /proc/399/cmdline
- cat /proc/400/cmdline
- cat /proc/402/cmdline
- cat /proc/404/cmdline
- cat /proc/406/cmdline
- cat /proc/409/cmdline
- cat /proc/431/cmdline
- cat /proc/433/cmdline
- cat /proc/699/cmdline
- cat /proc/700/cmdline
- cat /proc/702/cmdline
- cat /proc/704/cmdline
- cat /proc/708/cmdline
- cat /proc/719/cmdline
- ./t -t 3 ./p 119.81.62.166 53
- ./t -t 3 ./p 119.81.62.166 113
- ./t -t 3 ./p 202.65.65.34 113
- ./t -t 3 ./p 117.102.103.146 53
- ./t -t 3 ./p 117.102.103.146 113
- ./t -t 3 ./p 91.109.4.94 23
- ./t -t 3 ./p 91.109.4.94 113
- ./t -t 3 ./p 197.97.230.184 80
- ./t -t 3 ./p 197.97.230.184 113
- ./t -t 3 ./p 95.138.166.65 53
- ./t -t 3 ./p 95.138.166.65 443
- ./t -t 3 ./p 190.186.158.4 53
- ./t -t 3 ./p 190.186.158.4 80
- ./t -t 3 ./p 60.251.161.48 25
- ./t -t 3 ./p 60.251.161.48 53
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
Creates folders:
- /var/tmp/.
Creates or modifies files:
- /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
Deletes files:
- /var/tmp/. /fe931d2f7ab2250fa4d4f1f563c0628d
Other:
Collects CPU information
Collects RAM information