Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- rpcbind
- dhcpd
Launches processes:
- /usr/local/bin/.~9773ea dhcpd
Performs operations with the file system:
Creates or modifies files:
- /proc/sys/vm/nr_hugepages
- /usr/local/bin/.~9773ea
Deletes files:
- /usr/local/bin/.~9773ea"
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:53841
- 0.0.0.0:45927
Other:
Collects information about network activity