Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- 0z6k00wnil0lv
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8888
Establishes connection:
- 8.#.8.8:53
- 18#.##.138.97:2231
HTTP GET requests:
- http://###.##.229.215login.cgi
Sends data to the following servers:
- 75.###.185.20:80
- 20#.##.102.105:9997
- 22.##.56.13:82
- 73.###.158.194:8181
- 12#.##.136.122:9997
- 23#.##.236.224:8080
- 56.##.188.198:8080
- 24#.##1.138.13:443
- 46.##4.76.29:82
- 21.###.63.221:8090
- 20#.##6.5.26:8181
- 4.##.35.209:81
- 13#.##.78.172:443
- 22#.###.115.205:8181
- 14#.##7.135.175:80
- 18#.##.103.182:80
- 92.###.197.216:443
- 66.##8.73.53:81
- 24#.###.197.165:8090
- 11#.##5.103.79:81
- 19.##.0.118:80
- 19#.##9.121.143:443
- 24#.###.154.242:8081
- 25#.##3.244.20:9997
- 13#.##.92.65:8081
- 59.##.146.110:8090
- 6.##.75.214:81
- 69.##.65.162:81
- 15#.#28.6.38:81
- 24#.##0.75.202:82
- 25.##.221.19:8181
- 22#.##.226.228:9997
- 24#.##.56.76:9997
- 35.###.57.127:8081
- 21#.##4.36.238:81
- 16#.##.251.118:9997
- 18#.##7.31.167:82
- 21#.##0.15.23:81
- 23#.##.24.181:443
- 24#.##.206.189:9997
- 18#.##7.124.90:80
- 25#.##.38.165:82
- 71.###.126.177:8090
- 16#.##.56.236:82
- 22#.##.154.30:8081
- 20#.#.89.187:8080
- 19#.#.161.35:80
- 16#.##7.57.137:80
- 35.##9.72.81:80
- 59.##.84.74:80
- 36.###.163.109:81
- 10#.###.144.106:8080
- 23#.##5.207.175:81
- 15#.##.177.92:81
- 12#.##3.214.50:80
- 13.##.17.200:80
- 87.###.227.185:8080
- 24#.##8.149.164:81
- 15#.##.212.44:81
- 75.##.247.156:443
- 93.###.46.242:82
- 14#.##6.217.35:8090
- 24#.##.56.118:80
- 17#.##1.145.39:81
- 55.###.211.109:8081
- 53.###.190.209:8090
- 14#.##0.111.133:443
- 10#.##.203.130:8081
- 38.###.157.106:80
- 4.###.197.164:9997
- 20#.##7.184.84:82
- 19.##.231.118:82
- 23#.##.98.97:8090
- 14#.###.210.212:8181
- 23#.#9.9.33:80
- 19#.##1.17.147:8080
- 79.##.236.225:80
- 49.##0.22.11:81
- 16#.##1.137.178:80
- 18#.##.138.97:2231
- 22#.##.211.145:8080
- 16#.##4.45.219:8090
- 20#.##8.202.68:81
- 16#.##9.181.45:8080
- 20#.##.15.225:8181
- 24#.##0.138.44:8081
- 20#.##7.102.19:8090
- 40.###.39.170:80
- 21#.##3.66.68:8181
- 19#.#3.90.3:443
- 22#.##.192.5:8081
- 90.###.44.33:9997
- 21#.###.148.232:8181
- 14#.###.155.239:8080
- 63.##.214.245:82
- 24#.##0.16.205:443
- 22#.##.29.17:8181
- 11#.##.199.140:8081
- 33.##.137.158:8080
- 45.###.202.30:9997
- 22#.###.112.199:8080
- 15#.###.216.220:8090
- 24#.##.224.223:443
- 57.##.99.232:8081
- 13#.##.175.10:82
- 15#.##2.208.18:8080
- 28.###.6.56:8080
- 15#.##6.21.220:8081
- 26.###.115.189:8080
- 57.###.252.182:443
- 17.##.24.128:8090
- 21#.###.140.239:9997
- 13.##.48.2:80
- 22#.##.98.130:8090
- 11#.##1.24.2:8081
- 22#.#2.62.81:82
- 15#.###.250.125:9997
- 2.###.215.56:8080
- 11#.##9.82.49:80
- 20#.##6.37.31:80
- 15#.##8.7.169:8090
- 21#.###.155.210:8081
- 13#.##.119.177:8181
- 19#.##7.38.146:8090
- 23#.##8.109.90:81
- 2.##.#10.157:8080
- 23#.##.50.114:8181
- 12#.##.130.165:80
- 70.##.221.67:80
- 88.###.251.176:81
- 14#.##2.124.194:81
- 95.###.226.107:443
- 22#.##9.58.83:81
- 10#.##9.97.152:80
- 16#.#3.64.6:80
- 20#.##5.4.211:8080
- 20#.##.215.72:8080
- 72.###.202.230:8081
- 37.###.83.178:443
- 25#.##.198.91:8080
- 17#.##.25.49:8080
- 23#.##.104.156:8080
- 57.###.103.47:8081
- 76.##.229.211:81
- 14.###.216.107:9997
- 12#.##7.32.187:80
- 18#.###.115.121:8081
- 12.###.228.140:8181
- 13#.##1.117.32:81
- 15.###.212.151:82
- 11#.##.41.187:82
- 14#.##9.31.159:8080
- 15#.##6.207.41:82
- 65.###.217.210:9997
- 14#.##.51.252:8090
- 11#.##4.130.211:81
- 17#.##.250.18:81
- 14#.##.108.50:9997
- 16.###.147.67:9997
- 17.###.239.90:82