Trojan.SH.MIRAI.BOI

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de descarga

Guarda los archivos que descarga con los nombres siguientes:

• {directory}/sysctl
  where {directory} can be any of the following:
  • /tmp
  • /var/run
  • /mnt
  • /root
  • /etc/init.d
  • / (root directory)

Otros detalles

Hace lo siguiente:

• It switches to root user to have root privileges.
• It clears the following objects:
  • /etc/cron.d/start
  • /etc/cron.daily/dkpp
• It creates the following cron job to enable automatic execution of $PATH:/var/run/sysctl:
  • Paths:
    • /etc/cron.d/start
    • /etc/cron.daily/dkpp
    Schedule: At 00:00
    Command: 00 00 * * * root PATH="$PATH:/var/run/sysctl"
• It resets the IP policy table.
• It blocks incoming TCP connections on the following ports:
  • 22
  • 23
  • 80
  • 443
  • 8080
  • 9000
  • 8089
  • 7070
  • 8081
  • 9090
  • 161