Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- rtnmwe1jep0n7teq83vw
Performs operations with the file system:
Deletes folders:
- /null
- /var/log/syslog
- /var/log/daemon.log
- /tmp/clearsigned.message.cBNHlY
- /tmp/clearsigned.message.ql2Opd
- /tmp/clearsigned.message.4BdW6e
- /tmp/clearsigned.message.gb24Ai
- /tmp/clearsigned.message.UNxp4K
- /tmp/clearsigned.message.USxtZM
- /var/log/kern.log.1.gz
Deletes files:
- /null
- /var/log/syslog
- /var/log/daemon.log
- /tmp/clearsigned.message.cBNHlY
- /tmp/clearsigned.message.ql2Opd
- /tmp/clearsigned.message.4BdW6e
- /tmp/clearsigned.message.gb24Ai
- /tmp/clearsigned.message.UNxp4K
- /tmp/clearsigned.message.USxtZM
- /var/log/kern.log.1.gz
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:46372
Establishes connection:
- 8.#.8.8:53
- 18#.##1.61.24:53
- 0.0.0.0:0
- 91.###.137.37:53
- 19#.##.144.87:53
- 16#.###.128.166:64356
DNS ASK:
- hs####df2z.pirate
- ph####9rqd.parody
Sends data to the following servers:
- 16#.###.128.166:64356
Receives data from the following servers:
- 16#.###.128.166:64356