Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- kgitnnl0fn8anjiijb6hoi3b
Launches processes:
- sh -c wget http://api.ipify.org -qO-
- wget http://api.ipify.org -qO-
- sh -c wget ipinfo.io/95.211.190.199/org -qO-
- wget ipinfo.io/95.211.190.199/org -qO-
- sh -c wget ipinfo.io/95.211.190.199/country -qO-
- wget ipinfo.io/95.211.190.199/country -qO-
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 17#.##9.223.190:0
- 23.##.59.179:0
- 54.###.147.226:0
- 54.##5.71.235:0
- 18#.##.165.106:0
- 54.###.186.202:0
- 23.##.213.140:0
- 18#.#3.185.65:0
- 21#.#39.34.21:0
- 21#.#39.36.21:0
- 21#.#39.32.21:0
- 21#.#39.38.21:0
- 8.#.8.8:53
- 16#.##.147.162:101
HTTP GET requests:
- ap#.#pify.org/
- ip####.##/95.211.190.199/org
- ip####.###95.211.190.199/country
DNS ASK:
- ap#.#pify.org
- ip##fo.io