Technical Information
Malicious functions:
Launches itself as a daemon
Modifies router settings:
- /bin/nvram
Launches processes:
- sh -c echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &
- sh -c /bin/uname -n
- sh -c nvram get router_name
- /bin/uname -n
Performs operations with the file system:
Creates or modifies files:
- /etc/resolv.conf
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:35226
Connects to the following servers over the IRC protocol:
- Server: 14#.#6.102.30; Command: NICK x86|x|0|598889|unknown\nUSER op localhost localhost :...\n
- Server: 14#.#6.102.30; Command: PONG :FCB027DE\n
- Server: 14#.#6.102.30; Command: NICK x86|x|0|598889|unknown\n
- Server: 14#.#6.102.30; Command: MODE x86|x|0|598889|unknown -xi\n
- Server: 14#.#6.102.30; Command: JOIN #pruebass :777\n
Other:
Collects OS information