Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- dnsmasqd
Performs operations with the file system:
Creates or modifies files:
- /tmp/.spligjr2q0le.pid
- /root/.torrc
Deletes files:
- /root/.torrc
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:20938
Establishes connection:
- 127.0.0.1:65535
- [:##]:65535
- 8.#.8.8:53
- 127.0.0.1:48969
- 16#.##7.74.213:443
- 54.##.108.162:443
- 95.###.43.164:443
- 45.##.33.45:443
- 19#.###.206.50:20938
DNS ASK:
- ip##ho.net
- ip##fo.io
- id##t.me
- wh#####yip.akamai.com
- my##.#nsomatic.com
Sends data to the following servers:
- 16#.##7.74.213:443
- 19#.###.206.50:20938
- 19#.###.206.50:56668
- 19#.###.206.50:36926
Receives data from the following servers:
- 16#.##7.74.213:443
- 19#.###.206.50:56668
- 19#.###.206.50:20938
- 19#.###.206.50:36926
Other:
Collects RAM information