Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- qhysjeed
- vrxw
- [^$I$^]
Launches processes:
- sh -c /var/tmp/vrxwme vrxw &
- /var/tmp/vrxwme vrxw
- sh -c /var/tmp/dclyre &
- /var/tmp/dclyre
- sh -c /var/tmp/pnvfye pnvf &
- /var/tmp/pnvfye pnvf
- sh -c /var/tmp/myxmpv dbln &
- /var/tmp/myxmpv dbln
- sh -c /var/tmp/wfbuqv wfbu &
- /var/tmp/wfbuqv wfbu
Kills the following processes:
- /var/tmp/vrxwme
- /var/tmp/dclyre
- Unknown process with PID: 722
- Unknown process with PID: 724
- Unknown process with PID: 729
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/vrxwme
- /var/tmp/dclyre
- /var/tmp/pnvfye
- /var/tmp/myxmpv
- /var/tmp/wfbuqv
Creates or modifies files:
- /var/tmp/vrxwme
- /var/tmp/ps
- /var/tmp/dclyre
- /var/tmp/.tmp
- /var/tmp/pnvfye
- /var/tmp/myxmpv
- /var/tmp/wfbuqv
Deletes files:
- /var/tmp/vrxwme
- /var/tmp/dclyre
- /var/tmp/pnvfye
- /var/tmp/myxmpv
- /var/tmp/wfbuqv
Locks files:
- /var/tmp/ps
- /var/tmp/.tmp
Network activity:
Establishes connection:
- 14#.#2.52.87:80
HTTP GET requests:
- 18#.###.169.6/jm/jrd
- 18#.###.169.6/jm/lmmml
- 18#.###.169.6/jm/jpp
HTTP POST requests:
- 18#.##.68.100/__jb.php
Receives data from the following servers:
- 14#.#2.52.87:80