Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- kgwldjq7h3uwmp0qc1mmrwiw
Launches processes:
- sh -c mkdir -p /tmp/wp/log
- mkdir -p /tmp/wp/log
- sh -c ip route | grep 192.168.214.50 | awk -F '[ *]' '{print $3}'
- ip route
- grep 192.168.214.50
- awk -F [ *] {print $3}
Performs operations with the file system:
Creates folders:
- /tmp/wp
- /tmp/wp/log
Creates or modifies files:
- /tmp/wp/log
- /root/log
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:48101
Establishes connection:
- 8.#.8.8:53
- 43.###.105.140:39000
Sends data to the following servers:
- 43.###.105.140:0