Technical Information
Malicious functions:
Substitutes application name for:
- /usr/sbin/apache2 -k start
Launches processes:
- /tmp/upxDTSUK45AAVL <SAMPLE_FULL_PATH>
- uname -a
Performs operations with the file system:
Creates or modifies files:
- /tmp/upxDTSUK45AAVL
Deletes files:
- /tmp/upxDTSUK45AAVL
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 0.0.0.0:3303
DNS ASK:
- al#####991.no-ip.org