Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/wake
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K01wake"
- /etc/rc1.d/K01wake"
- /etc/rc2.d/S01wake"
- /etc/rc3.d/S01wake"
- /etc/rc4.d/S01wake"
- /etc/rc5.d/S01wake"
- /etc/rc6.d/K01wake"
Malicious functions:
Gains root privileges
Substitutes application name for:
Manages services:
- update-rc.d wake defaults 99
- systemctl daemon-reload
Launches processes:
- sh -c update-rc.d wake defaults 99
- /sbin/insserv wake
- sh -c chkconfig --add wake
- sh -c chkconfig wake on
- sh -c nohup /usr/bin/wake -c 1 &
- nohup /usr/bin/wake -c 1
- /usr/bin/wake -c 1
- netstat -nlp
- grep :39999
- sh -c uname -a
- uname -a
- sleep 5
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/wake
- /etc/init.d/wake
Creates or modifies files:
- /usr/bin/wake
- /etc/init.d"/.depend.boot
- /etc/init.d"/.depend.start
- /etc/init.d"/.depend.stop
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:39999
Establishes connection:
- 13#.##.18.147:3308
Sends data to the following servers:
- 13#.##.18.147:3308
Receives data from the following servers:
- 13#.##.18.147:3308
Other:
Collects CPU information
Collects information about network activity
