Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- nyjnnwnfbc2wynpojtmjgsm
- cf1vsj5iw0lsjvjurzn1ldfu
- 4afwsg1xd5c2x4mc015tbs
- msiizdjozzx43ua221cj
- yo4wwxbnfrati5ey1jdu
- leatrte5k42xa5j53dq1iw
- gz2tjb5ytbrhopegzv4t
- vqqjwpploub2hm5e05pho
- ceoioll0tnmmyehxdimcs2j2
- yc3rfphd2hx2bigw1mjgr
- zaq2jfty3r1lr0hyp5p0z1
- vutb5vfhwjiuzxclni2c
- zorvvqmuicr2se0zskkb
- prbhhn1kxoz04kdrbsgi
- 0b3kniwny3ug0tga5kct
- ogymn1bp2nejgiwnztcsti
- dqs10ds0zh1qmhhnlb4n
- afs4qiqidgmlqygrv4wwde0
- y4lelct00dz5t10ejz2evq
- mki0src130obez5sn1wy
- xbk4rzpwmd43ikimjvnf
- iyypuhy5stuxa1n0hfz3l
- jxocnm4ykfbdwee5eip3bs
- dst3cn0saaj5ysje2n5kkl5
- dmcccdvnoh1dmqfrxv2s
- ql4bhjwykrwovzawip2v4
- wqx4if1faldlyxvgsyxr
- fzcnudqbqdjpfmdvgw5ikwqm
- ejwukpwpqd5xh1lj0juevo3
- ablpvkowbaxawuhwpkmqih2
- mqz1bp52a2upcdycainoflf1
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.209.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685