Technical Information
Malicious functions:
Removes itself
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'uplugplay.service']
- ['systemctl', 'start', 'uplugplay.service']
Launches processes:
- systemctl enable uplugplay.service
- /sbin/killall5 pidof upnpsetup
- pgrep upnpsetup
- pgrep uplugplay
- /bin/systemd-tty-ask-password-agent --watch
- pidof uplugplay
- pidof upnpsetup
- /sbin/killall5 pidof uplugplay
- pgrep <SAMPLE>
- pidof <SAMPLE>
- systemctl daemon-reload
- systemctl start uplugplay.service
- /sbin/killall5 pidof <SAMPLE>
Kills the following processes:
- dash
- systemd-tty-ask
Performs operations with the file system:
Modifies file access rights:
- /usr/sbin/uplugplay
Creates or modifies files:
- /etc/hosts
- /usr/sbin/uplugplay
- /lib/systemd/system/uplugplay.service
- /dev/tty
Other:
Collects CPU information