Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- grep -v grep
- ps
- grep tcpdump
- ps aux
- ps -w
Performs operations with the file system:
Creates or modifies files:
- /root/.torrc_5
Deletes files:
- /root/.torrc_5
- /root/_wfs34d53uioj_rtg564w-__ewfd-ad--sdf.ad3sf/key-pinning-entries_5
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:60005
- 0.0.0.0:20005
- 0.0.0.0:40005
Establishes connection:
- 127.0.0.1:60001
- 127.0.0.1:60002
- 127.0.0.1:60003
- 127.0.0.1:60004
- 18.#.0.1:9
- 13#.###.47.229:30004
- 45.##.110.200:30004
Other:
Collects CPU information
Collects RAM information
Collects information about network activity