Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- rbvjbspumuwy1gr4fs1lv4
- lk2zncql4wswmvbstpdvby
- okrzfmjwo2oikmyvzcwn3
- ndo5suydosoob0lyeaymc4yj
- e0gmyvotwj0mejicmhn1d44
- 2rbb3m3kd0tm5jbpankz2iq
- yxxjgvmfnmij45xxiagsfxx
- 1kfyur2jgs02apesj3f4zakw
- ldgydrzd5erbxelowq5p2dv
- g4vi5aucl4xdzwhrry3heynd
- f0wfltg2oineht1l4aou
- wqxuojrit4xrrflqnbvwz0
- alabuazbpiz4h5ahv2kaf0
- laopatz5tmvkmpbbfcqgsc
- 1iak2matwbg0r2nwsoqif
- iw0230lv1fkqxy0ajtunmozr
- zfoj5p3qvv2coyjnlv0m
- qqdszgjmlcmbznpkuzinmf
- zagsjxou5nbeyrqreja5
- gxyqdlhdvi4lcdrb5feihd
- 3fqlnnkulkce4cttmyb5p
- vutckpixw2j30hv1fhhqnmp
- iywq53i543mbzgrwmt2mt
- el2w2gqrdurjbmzopfefx
- cededmkz3mesyfwiplwhidj
- r42odqhobxbrhvcvjwlvkx
- ytl5gdum1capgmbq5jz1tlmr
- ukmcwrctjilsz1fqsbljog5
- cz3na2nyw1rjytywiz21m
- tbsogpsiyw24siitzvep1
- 4fdu0eo1hxmwokmi2xfm
- 4f4yfsxqvwcs12wsmqsmv
- jpr3rdn0rnnlx44zf3o05
- wtqsy0qpv5srwqpi5h1jxx
- tui3o20xlqcsg4tbyi31r
- f2b1kzkfkux5jz2yltawns
- pkrjigx5w4sgwqwgubgw2
- c4looxjhkcb4imwmm1rrk
- wdntd4pmiu1ar1fwf1adhx
- 4bpuozjnqh0r2e4tyirjws
- rth2j3k1s4bue3yljdwde
- c534alf5gq5vuuwew1ko
- wcahjsd4u4vwgyq1hdtuoj
- d1uofn2a1cn4civqkmwx
- cyd51tesncjweqkyqrhwh
- hebg5pggf0ubto2rxuuslg
- 4ckvqisgmhzkgak1nxt2kz
- wodjcgmtyhtspk3zdfgxztak
- oxrhdvgtwr0ex0m0gd0i
- 5kzydhfpx21n1i21d00guar
- lzwiqevlvxwwbub0gbeq
- pue4dq2jovpdsboogjwr5cu
- bjydrnnnn52kwwgl2ap2
- 0txe1fd3h3tksh40qrrrmlr
- 2rdd4k4eapi2pxorx5zk
- omgeelimfbglbmz3fg1u
- vpyryznqek3ve23yxrhxf
- ecbx0mjapbavlsxlz4rp1new
- eub2kxeyb1ye4pi2q3d3
- oxcvz0dckfsnw1s2k1zq
- gknnpjspo2waeaxnl10spzxw
- 0uetkuvmyskdrduopliiyaxp
- gfsvi331yemprfghjklbtix
- b03ioktajciil4tpiusu
- yx4z053v3t2xnufxiyae
- 1y0sxmydy1jq4o1slciyqnx
- winkftkjf3eoih503medgy1
- q1y44b4uliajdyfw5oewqj1
- i2ywx3hf4yq4qs41b4v5
- go4rnykqlkzlcxfakgcwjo
- rp5xnu14znlbhchbh1d2ohw
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.218.50:3467
Establishes connection:
- 8.#.8.8:53
- 20#.###.251.223:32145
Sends data to the following servers:
- 20#.###.251.223:32145
Receives data from the following servers:
- 20#.###.251.223:32145