Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/knlib
- /var/spool/cron/crontabs/root
- /etc/cron.d/.lib-knlib4
- /etc/cron.hourly/.lib-knlib4
- /etc/cron.daily/.lib-knlib4
- /etc/cron.weekly/.lib-knlib4
- /etc/cron.monthly/.lib-knlib4
Malicious functions:
Manages services:
- ['systemctl', 'daemon-reload']
- ['systemctl', 'enable', 'knlibe.service']
Launches processes:
- /bin/bash /etc/init.d/knlib start
- bash -c ufw disable
- chattr +ia /etc/cron.monthly/.lib-knlib4
- chattr +ia /etc/cron.hourly/.lib-knlib4
- cp -f -r -- /bin/knlib /bin/klibsystem5
- chattr +ia /etc/cron.d/.lib-knlib4
- nohup ./klibsystem5
- chattr +ia /root/.bash_profile
- /tmp/-python3
- chattr +ia /etc/cron.weekly/.lib-knlib4
- pgrep -f klibsystem4
- rm -rf -- klibsystem5
- crontab -
- crontab -r
- chattr +ia /etc/init.d/knlib
- pgrep -f klibsystem5
- bash -c echo \x22* * * * * nohup /tmp/.klibsystem5 >/dev/null 2>&1\x22 | crontab -
- chattr +ia /etc/systemd/system/knlibe.service
- chattr +ia /bin/knlib
- chattr +ia /etc/anacrontab
- chattr +ia /etc/cron.daily/.lib-knlib4
- chattr +ia /var/spool/cron/.lib-knlib4
- /usr/bin/pgrep pkill -f .klibsystem4
Performs operations with the file system:
Modifies file access rights:
- /etc/init.d/knlib
- /usr/bin/knlib
- /var/spool/cron/crontabs/tmp.bxZenD
Creates or modifies files:
- /tmp/-python3
- /tmp/.bashirc
- /etc/systemd/system/knlibe.service
- /root/.bash_profile
- /usr/bin/knlib
- /tmp/.klibsystem5
- /var/spool/cron/crontabs/tmp.bxZenD
- /var/spool/cron/.lib-knlib4
- /etc/anacrontab
Locks files:
- /tmp/.bashirc
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:59475
Establishes connection:
- 51.###.171.23:80
- 51.###.171.23:443
Sends data to the following servers:
- 51.###.171.23:80
Receives data from the following servers:
- 51.###.171.23:80
Other:
Collects OS information
Collects CPU information