Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- /var/Sofiac2c9baa18a2e8b6b51149ef3aaebb8b00977
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:15087
Establishes connection:
- 8.#.8.8:53
- 45.##.24.43:12028
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Attacks using a special dictionary (brute-force technique) via an undefined protocol.
DNS ASK:
- dn#.#yberium.cc
Sends data to the following servers:
- 16#.##3.40.190:26
- 10#.##6.77.26:26
- 75.###.172.190:26
- 72.###.185.249:26
- 14.##.148.109:26
- 2.##.53.76:26
- 16#.##.47.163:26
- 12#.#3.91.63:26
- 45.###.72.120:26
- 45.##.24.43:12028