Technical Information
Malicious functions:
Launches itself as a daemon
Modifies router settings:
- /bin/nvram
Launches processes:
- sh -c echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &
- sh -c /bin/uname -n
- sh -c nvram get router_name
- /bin/uname -n
Performs operations with the file system:
Creates or modifies files:
- /etc/resolv.conf
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:39223
Establishes connection:
- 14#.##.102.30:9090
Other:
Collects OS information