Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- nwxpwqix
- kiwt
- [^$I$^]
Launches processes:
- sh -c /var/tmp/kiwtyq kiwt &
- /var/tmp/kiwtyq kiwt
- sh -c /var/tmp/qsvwtq &
- /var/tmp/qsvwtq
- sh -c /var/tmp/enhdsy bnts &
- /var/tmp/enhdsy bnts
Kills the following processes:
- /var/tmp/kiwtyq
- /var/tmp/qsvwtq
- Unknown process with PID: 723
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/kiwtyq
- /var/tmp/qsvwtq
- /var/tmp/enhdsy
Creates or modifies files:
- /var/tmp/kiwtyq
- /var/tmp/qsvwtq
- /var/tmp/enhdsy
- /var/tmp/hedgyy
Deletes files:
- /var/tmp/kiwtyq
- /var/tmp/qsvwtq
- /var/tmp/enhdsy
Network activity:
Establishes connection:
- 14#.#2.52.87:80
HTTP GET requests:
- 18#.###.169.6/jm/jrd
- 18#.###.169.6/jm/lmmml
- 18#.###.169.6/jm/jpp
Sends data to the following servers:
- 14#.#2.52.87:80
Receives data from the following servers:
- 14#.#2.52.87:80