Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- 30nozsawauojalu1wyr20ck0
- pxer11jl0j0yjrupktlfu
- 4frrl2ffkczxeyp3dcnm
- ef11ilo51ddlngkq00tfsflx
- cb2l3xnqbdc1mfiu0xgnue51
- pgfymrloiqmhzl5bcu1bewj5
- dy5n51plcy2kqyuny0i4
- qg4f4jgnnw3wacctrddcil
- qncaahe2ghw2fqk3tvz4ljvx
- d43wesctecyir3gfwix2si
- p5zok2tjnzvnxdzkogcxs
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.209.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685