Technical Information
Malicious functions:
Removes itself
Launches processes:
- /usr/bin/python3.9 /usr/bin/python3 -Es /usr/bin/lsb_release
- <SAMPLE_FULL_PATH> -d
Kills the following processes:
- python3.9
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 16#.##1.142.159:80
- 18#.#6.76.76:53
- 11#.#70.8.59:9
- 11#.#70.8.61:9
- 11#.#70.8.57:9
- 11#.#70.8.60:9
- 11#.#70.8.56:9
- 11#.#70.8.62:9
- 11#.#70.8.58:9
- 11#.#70.8.59:80
DNS ASK:
- so###.huawei.com
Sends data to the following servers:
- 16#.##1.142.159:80
- 11#.#70.8.59:80
Receives data from the following servers:
- 16#.##1.142.159:80
- 11#.#70.8.59:80