Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Launches processes:
- /usr/bin/perl <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
- /tmp/1515810938
- /tmp/15158109381
- /tmp/1515810949
- /tmp/15158109491
Deletes files:
- /tmp/1515810938"
- /tmp/15158109381"
- /tmp/1515810949"
- /tmp/15158109491"
Network activity:
Establishes connection:
- 18#.##6.208.157:80
- 19#.##.81.163:80
- <LOCAL_DNS_SERVER>
- 67.###.183.105:80
HTTP GET requests:
- 50.##.24.79/
- ad###tise.com/
- 19#.#42.70.4/
- be###ce.net/
DNS ASK:
- ad####dpromoan.com
- se####ingonlyup.net
- ad###tise.com
- pr####upstudios.org
- be##nce.net