Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Performs operations with the file system:
Creates folders:
- /<SAMPLE>m
- /<SAMPLE>w
Creates or modifies files:
- /var/run/vpn.pid
- /run/vpn.pid
Network activity:
Establishes connection:
- 127.0.0.1:9050
HTTP GET requests:
- ap#.####y.org/?format=json
DNS ASK:
- ap#.#pify.org