Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- /var/Sofiaaaf88e500d4b7f53621399e225736da79cc7
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:15087
Establishes connection:
- 8.#.8.8:53
- 45.##.24.43:12028
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 51.###.150.226:23
- 10#.#5.109.5:23
- 14#.##0.18.226:23
- 19.###.100.175:23
- 1.###.5.160:23
- 15#.##6.110.3:23
- 89.###.186.25:23
- 17#.##.34.173:23
- 18#.##0.28.230:23
- 45.##.24.43:12028