Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- zn3ir2dr1apa4xuzxy5ujw
- jffe5njy0lewlrpkjncg
- 0xyirqrgpe12mzuuthm0yq
- xowjwrx1oiyyl41l1fl42h
- ygpttjkcn2pl3kpzsp5vmr2
- yupyhnrj43ezmqh3w3gx3se
- lwjnmhs3f1fjzd4ih1slvya
- pyf2wyla4n30cfqkd4silof1
- fva1mgrmglydoefdlpionexy
- mich0w1yvs3jnal2johf5c4
- 4mgbsnwqvsw42cv2tpgwl
- 2xi1sfrnowdvymh3g4ilt4up
- g3lchrahfewckeezcsnzo
- o5lp4wyeyqlgvczqplju45
- tzd1phgm4kszo4nray5cnqec
- 0hw3530t3zz1dey2cgeai
- qiog4r5sfj542vecsd4u
- rw2oymv0or34v2ebl2whhl
- rjykxpadqfjvpszmyekicb1
- eio4hue3gsqckrnsr2m0
- o50rltvxh4u2sheuwvwzrb4
- 2jrhtooypuy5vw3qeahkcmg
- hi0xdmeo0yxgzc0opwfgmsx
- 5hobnxvdovzguhpra4nzfhc
- xcsf2dpzqauxbzxgws11o
- hx3wmevmigp1q5311e52kxt5
- qtelf4awl3l1k4iadfhpvi
- yfakiqbaehcxmludhufmp
- rqbrkpqj3qqth5qlpxar
- rfbbeiojzywxjotkenuhc
- fphulgwnshd5jeatx5rbu
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.200.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685