Technical Information
Malicious functions:
Substitutes application name for:
- /usr/sbin/acpid
Launches processes:
- /tmp/upxBGUDDUMAAVO <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
- /tmp/upxBGUDDUMAAVO
Deletes files:
- /tmp/upxBGUDDUMAAVO
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
Connects to the following servers over the IRC protocol:
- Server: 5.###.96.210; Command: NICK sean\n
- Server: 5.###.96.210; Command: USER skru 19#.#68.216.50 irc.cryptostorm.is :a\n
- Server: 5.###.96.210; Command: PONG :64C1B3E1\n
- Server: 5.###.96.210; Command: MODE sean +x\n
- Server: 5.###.96.210; Command: JOIN #vbrxmr\n
DNS ASK:
- ir#.##yptostorm.is
Sends data to the following servers:
- 1.#.1.1:1