Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- xy0exmx5o41tuc0eshni
- kxzwgviigpdktmd21wfj
- 5wqrazb2lkg30ejnou2huv
- qrkolttx3o3avmjs0edsb
- v52zmvrivobbtyutleaxaaq
- hloxukkyzgnpa5zrdagvg
- q40neojy5k0joe10qcshx1hc
- hp52tpg1bfprjdtgjbbs4mrf
- 3jmlvmpecphw1flohjj2ghc
- vappny2uawsxegybbrbmer
- bjbhk1yhtjkrt5juqco4gny
- jvrbrlub3bulnyy1ksla
- cm5ln4s5rp2khoxxxbfrhv
- rlfxc2s0adlhcznt41y0ez
- ugbvzycljcgvsza2qalues0
- ulpyzpyte35sfzttaesyqi
- o4k3poxnvl05ku5a2bsogiz3
- bgcommfq4taarjzx2rda
- l4udfduyvxtttlszyaghj
- izaofhh4zsnka5k4xgzph
- v5vk543cls5ns1nxkmyi0hm
- atcmu4phfhcehr51uj2dt
- 341tg2wwnzfilhvc4fqtmffl
- 0wee1zj0hv4lak0ftfabv000
- vwskjpk4gbjqckxin3x15jt5
- ezaxmoqi4wxuhxhuoye3cw
- s4plwjt30tiastqhh3zu
- kyempwmzvku2kk5u4rjupq
- fjcececaqkb01fi4whbb
- zvbk2vge4olon4krqtlg2vpc
- ef0fzebuigyalqqoxur5g3js
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.211.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685