Technical Information
Malicious functions:
Performs process tracing:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Launches processes:
- /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/bash <SAMPLE_FULL_PATH> -c
- ./init
- head -n1
- tr -d ]\[\-\:\.
- grep -i aes
- cat /dev/urandom
- tr -cd a-f0-9
- head -c 32
- mkdir -p /var/tmp/. /
- touch /var/tmp/. /7fecbac09bce941f5ede03a65268905f
- chmod +x /var/tmp/. /7fecbac09bce941f5ede03a65268905f
- rm -rf /var/tmp/. /7fecbac09bce941f5ede03a65268905f
- ps x
- grep -v 715
- awk {print $1}
- grep -va grep
- cat /proc/1/cmdline
- tr -d
- grep -a gmail.com\|lkrbugs\|10010001.xyz\|ail.com\|47EaZKYrX8NBBCE4N1H5zhXn3FR3tFmGYSBQWPPt2Vg8GmCwiGuwKdMbXKHTCCKpAUjU9AJ6Se4PU7G7uDLDoE4h3dtjkck\|28MhEWJJa4N7FAXKgwRafGSoz83LNdVHmMgDWFJwUDvMX4ppxJV91H5AgaYHerujLwRmAMLeG71puYj4uKPixpchRMs8oDh
- tr -d \n
- grep -va startcmd
- cat /proc/2/cmdline
- cat /proc/3/cmdline
- cat /proc/4/cmdline
- cat /proc/5/cmdline
- cat /proc/6/cmdline
- cat /proc/7/cmdline
- cat /proc/8/cmdline
- cat /proc/9/cmdline
- cat /proc/10/cmdline
- cat /proc/11/cmdline
- cat /proc/12/cmdline
- cat /proc/13/cmdline
- cat /proc/14/cmdline
- cat /proc/15/cmdline
- cat /proc/16/cmdline
- cat /proc/17/cmdline
Kills the following processes:
- <SAMPLE>
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/. /7fecbac09bce941f5ede03a65268905f
Creates folders:
- /var/tmp/.
Creates or modifies files:
- /var/tmp/. /7fecbac09bce941f5ede03a65268905f
Deletes files:
- /var/tmp/. /7fecbac09bce941f5ede03a65268905f
Other:
Collects CPU information
Collects RAM information