Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- a89rdarf
Launches processes:
- sh -c wget http://api.ipify.org -qO-
- wget http://api.ipify.org -qO-
- sh -c wget ipinfo.io/95.211.190.198/org -qO-
- wget ipinfo.io/95.211.190.198/org -qO-
- sh -c wget ipinfo.io/95.211.190.198/country -qO-
- wget ipinfo.io/95.211.190.198/country -qO-
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 54.##3.123.39:0
- 54.##4.36.156:0
- 23.##.114.123:0
- 50.##.248.221:0
- 54.###.234.215:0
- 23.##.121.219:0
- 21#.#39.36.21:0
- 21#.#39.32.21:0
- 21#.#39.34.21:0
- 21#.#39.38.21:0
- 8.#.8.8:53
- 18#.##.226.245:101
HTTP GET requests:
- ap#.#pify.org/
- ip####.##/95.211.190.198/org
- ip####.###95.211.190.198/country
DNS ASK:
- ap#.#pify.org
- ip##fo.io