Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- qn2eaapcodv5q4qdhydyxk
- 5v0riubpw4cqsokgxkwm5x
- bshmnvurtizjsbwknql1axj
- x5jjvas4r4psgtysnnqyhn
- qkqxxfoiohlhh1xkco454y
- 42r1qpjjudu450sx5tcwkb1
- rklk244g4wfnlmdq0w4znt
- lpfdwprfqfm5eigzdthjqvej
- duqhh2ojtzarq2re4owm0x3x
- jez5qiqitkwosdap20h2xawi
- zfxncoojzr4wazrkcxoga
- 5kzyrabm0erhgrgukthi2
- hnnend5aoadcw5zkqukyolb0
- gsvqpjrp2ffy1f1dvw1pfc
- a0b1nuzszbescsf1reahveu
- oi50niv2z5rtxmuyfruzx
- s10m5irktik00b10qrixnw2r
- ljrqmtyz3vneyqleu4in1tfy
- w1lwg0zcyoe0vvnhrkdmh
- 1rnuy04sr2k2e0btya2mk
- rynwykvuuieac4vfkvgh3k
- xtialxlow2uji2drimam
- 55pmkhf2dntkmp2puyeqrjk
- bmgybht5qdsymmhnzr0fubn
- 0ncawxqle4hbwvskuwxplu
- tueikcbxtgyqtzdn0ehtynee
- 2blrnsufzum4c5etff32tvt
- hwytrqvotymrh4eyaots0l
- bcirxf0qn0ssxzaqcwqm5dvu
- ktm0fg4clf03mhkwq3f0f
- wy3gv4fnhxkqit03heruykxv
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.200.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685