Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- gwd0ap2z3g31wyndt2mmu3xu
- 5btlvwk3m41dbuvczafuezs
- gvm4auf1y24ayuru4fkpl2
- njufzmc3xfsdkajfecwee
- maxanbl0iyrimibrpykts
- c15zjp5yxgdk5pp3rsp2s
- 1u5a0epiqy2rfcrhitd0p
- b0qiqu1nzv251pxabugs
- vemwy5y5eqhdxii4un2vkg
- lo4wkn0lf3cb3omugn0kfvu
- zhz4nxyctokyhw2alvz0
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.218.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685