DoubleFantasy

When executing file, escalate privilege of file first, then use the excele function with parameter executable files... execle("/usr/bin/sample","sample", NULL, %envp%);

The script realizes the startup by using the service. It creates the script in the etc / rc.d / directory (S85s%). This script will run with the start parameter as the service which is executed when open the computer.

Run with the daemon mode in the sample, achieve the ability of self-protection.

The script realizes the startup by using the service. It creates the script in the etc / rc.d / directory (S85s%). This script will run with the start parameter as the service which is executed when open the computer.

Run with the daemon mode in the sample, achieve the ability of self-protection.

These components act as Rootkits... This is a rootkit program on the Solaris platform of the SPARC architecture. It is primarily responsible for hiding the main function sample files like other rootkit programs, as well as the associated derived files and itself, including process, file, and service information.

The function and data called by this sample is dynamically loaded and debugged... We explain the calling addresses through dynamic analysis decryption.

After running, it can combine two sets of strings... to generate file name as its own new file name, and copy itself to the / sbin / directory... these words are highly frequency words or suffix used in system files and system command.

Traversing system files, clearing / var / log / lastlog records... 0x42 Clear traces of infection, delete itself.

The sample will generate MD5 based on HOSTID... splice .tmp with the first six bits into a folder name and create the folder... It is responsible for hiding all the files in this folder.

The malware starts process fork() and determine the PID number of its child process. If the execution succeeds, then the main function will exit and cannot debug.

Traversing system files, clearing / var / log / lastlog records, obtaining system account password information... Reading the system account password file, retrieve user information and password.

If the parameter '-c' engages in, only system information can be obtained and it can be regarded as scene detection... Collecting information about infected computers, including system directory, file extension, and other information.

Obtaining user’s login information getpwnam... Getting user’s login password getpwuid... Reading the system account password file, retrieve user information and password.

The malware starts process fork() and determine the PID number of its child process. If the execution succeeds, then the main function will exit and cannot debug.

This implant collects system information and credentials and provides generic access to an infected computer.

Many encryption algorithms used in communication and information... Network communication encryption... This sub key is used for encrypting and decrypting to send and receive data.

Connecting remote sever and making different operations based on remote control instructions... 'GET ', 'POST ', 'HTTP/1.1\r\n' ... Connecting remote URL address.

The download executable samples are the same as Windows, use the same instruction tag through three steps (create, write, execute) to complete the download and execution function.