Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- vqtlisevvvc11jswrgops
- oghuxd0mgsdrhhjskvnmp
- xnirkppwhw35bif2rbvcph
- cdmytzaamfrmmqo4zxt1x
- kf4amna0wtsauzr44ovkvfx
- ltb0l32qxbhleaq4xsrj4p0
- twll1z32z1d4dwp2nfyxov
- bwtsgdydmgrooi4xstd4ydiu
- qcnppre1ucx0l1jtycbuz
- qy5jj5q4pgufdymddwoom5a
- odxocuszurravosk5qeg
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.217.50:3467
Establishes connection:
- 8.#.8.8:53
- 20#.###.251.223:32145