Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- KxaaNtMaRe1btVeuWvw2voQWjaAt8MN44BcWlbNNRtVMKKV8KXbbQxAMay7vNwwAlMAWntp8M18a6Wxtjvjj1oyAXtlyK7tvRBdtAHnVj1HjjaRAyHoNeAyeR6aKWMjMawAd2bACcjwdKAHaWtj1WvMtevv1eontjooboMoewKnj1MVvbboCQdKvWARuVKWddHtbc1NCnob7728MM3etNoaWjuArav4MnAcQNbyjKN1d6dAAKAArerelBH4oKn4AobuNjjcAKKtKlWpu8evX7oxARyx8pbyAK6j8yj2Aj1bKnyACXpn6udaa4y6jxMbtjCl2dMRbAuKu1c2tjAojjAjM1RoMAnMpMpavb3jvAbaNuAKNej8NC8t4WpvBjejCnaaAaj37QaN3pn3oy7jbeot11jo2B6XMAwdBeQQAW3vrARc1vAjMKdvawA71bAjwtWwKwnyb1K8QNlawHoaKyxjAjAaHvpWMu4jKvAAatbMvKKwKbNljtjadM1NwQjQjMoyW3cuwav8VjVC1a1bv12AKWaateMtyNjnMbWWQ
Kills the following processes:
- <SAMPLE>
Network activity:
Awaits incoming connections on ports:
- 19#.###.212.50:56242
Establishes connection:
- 8.#.8.8:53
- 5.#.##.205:34255
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- sk##ine.wtf
Sends data to the following servers:
- 5.#.##.205:34255
Receives data from the following servers:
- 5.#.##.205:34255