Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- a
Removes the following system files:
- /usr/sbin/reboot
- /usr/sbin/shutdown
- /usr/sbin/poweroff
- /usr/sbin/halt
Performs operations with the file system:
Creates or modifies files:
- /self
- /proc/528/cmdline
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:3589
Establishes connection:
- 18#.##7.3.184:3589
- 8.#.8.8:53
Receives data from the following servers:
- 18#.##7.3.184:3589